Red Hat Security AdvisoryRHSA-2023:5982
Red Hat Satellite Client security and bug fix update
Released 2023-10-20 · Red Hat rating Important · View on Red Hat →
Fixed in
- Satellite Client 6 for RHEL 6 puppet-agent-7.26.0-3.el6sat
- Satellite Client 6 for RHEL 7 foreman_ygg_worker-0.2.2-1.el7sat, puppet-agent-7.26.0-3.el7sat, yggdrasil-0.2.3-1.el7sat
- Satellite Client 6 for RHEL 8 foreman_ygg_worker-0.2.2-1.el8sat, puppet-agent-7.26.0-3.el8sat, yggdrasil-0.2.3-1.el8sat
- Satellite Client 6 for RHEL 9 foreman_ygg_worker-0.2.2-1.el9sat, puppet-agent-7.26.0-3.el9sat, yggdrasil-0.2.3-1.el9sat
Fixes 5 records
Priority CRITICAL 93
In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.96391 · Published 2022-06-21 · Partial fix CWE-78
Priority CRITICAL 90KEV
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.99999 · Published 2023-10-10 · Partial fix · 1.28.0, 0.17.0 +9 CWE-400
Priority CRITICAL 90
The c_rehash script does not properly sanitise shell metacharacters to prevent command injection.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.82612 · Published 2022-05-03 · Partial fix CWE-78
Priority LOW 39
A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03796 · Published 2023-10-11 · Partial fix · 1.20.10, 1.21.3 +1 CWE-770
Priority LOW 33
An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.06077 · Published 2022-12-08 · Partial fix · 1.18.9, 1.19.4 +1 CWE-770
THREATIST.IORead the docs