Red Hat Security Advisory

RHSA-2023:0261

Satellite 6.12.1 Async Security Update

Released 2023-01-18 · Red Hat rating Critical · View on Red Hat →

Fixed in

Red Hat Satellite 6.12 for RHEL 8 candlepin-4.1.18-1.el8sat, candlepin-selinux-4.1.18-1.el8sat, foreman-3.3.0.18-1.el8sat +41

Fixes 3 records

TI-2022-20885 CVE-2022-42889 · GHSA-599f-7c49-w659

Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults

CRITICAL 94

Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99931 Published 2022-10-13 Partial fix · 1.10.0 CWE-94

TI-2022-13933 CVE-2022-32224 · GHSA-3hhc-qp5v-9p2j

Deserialization of untrusted data in https://github.com/rails/rails

HIGH 82

A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record < 7.0.3.1, <6.1.6.1, <6.0.5.1 and <5.2.8.1 which could allow an attacker, that can manipulate data in the database (vi…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02601 Published 2022-12-05 Fixed in 7.0.3.1, 6.1.6.1 +2 CWE-502

TI-2022-20342 CVE-2022-42003 · GHSA-jjjh-jjxp-wpff

In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion…

LOW 39

In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGL…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03409 Published 2022-10-02 Partial fix · 2.12.7.1, 2.13.4.2 CWE-502