Read the docs
Red Hat Security Advisory

RHSA-2024:2010

Satellite 6.15.0 release

Released 2024-04-23 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 18 records

TI-2023-25769 CVE-2023-47627 · GHSA-gfw2-4jvh-wgfg

Request smuggling in aiohttp

Priority HIGH 72

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00857 Published 2023-11-14 Fixed in 3.8.6 CWE-444
TI-2023-18906 CVE-2023-37276 · GHSA-45c4-8wx5-qw6w

aiohttp vulnerable to HTTP request smuggling

Priority HIGH 72

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01337 Published 2023-07-19 Partial fix · 3.8.5 CWE-444
TI-2023-03991 CVE-2023-4320 · GHSA-7v43-v54c-p26h

Satellite: arithmetic overflow in satellite

Priority MEDIUM 40

An arithmetic overflow flaw was found in Satellite when creating a new personal access token.

CVSS 3.1HIGH 7.6 Network Low privileges No interaction EPSS 0.00653 Published 2023-12-18 Fixed in 3.9.1.6-1.el8sat CWE-613
TI-2023-23390 CVE-2023-43665 · GHSA-h8gc-pgj2-vjm3

In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the…

Priority LOW 36

In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service) attack via c…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01462 Published 2023-11-03 Partial fix · 3.2.22, 4.1.12 +1 CWE-1284
TI-2023-21773 CVE-2023-41164 · GHSA-7h4p-27mh-hmrw

In Django 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5…

Priority LOW 36

In Django 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5, django.utils.encoding.uri_to_iri() is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode cha…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01519 Published 2023-11-03 Partial fix · 3.2.21, 4.1.11 +1 CWE-1284
TI-2024-14372 CVE-2024-21647 · GHSA-c2f4-cvqm-65w2

HTTP Request/Response Smuggling in puma

Priority LOW 35

Puma is a web server for Ruby/Rack applications built for parallelism.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00958 Published 2024-01-08 Partial fix · 5.6.8, 6.4.2 CWE-444
TI-2023-04777 CVE-2023-5189 · GHSA-55g2-vm3q-7w52

Hub: insecure galaxy-importer tarfile extraction

Priority LOW 31

A path traversal vulnerability exists in Ansible when extracting tarballs.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00982 Published 2023-11-14 Fixed in 0.4.18-1.el8ap, 0.4.18-1.el9ap +2 CWE-23
TI-2023-19462 CVE-2023-38037 · GHSA-cr5q-6q9f-rq6q

Incorrect permission assignment in Rails ActiveSupport

Priority LOW 25

ActiveSupport::EncryptedFile writes contents that will be encrypted to a temporary file.

CVSS 3.0MEDIUM 5.5 Local Low privileges User interaction EPSS 0.00274 Published 2025-01-09 Partial fix · >= 5.2.0, 5.2.0 +2 CWE-732
TI-2023-18320 CVE-2023-36479 · GHSA-3gh6-v5v9-6v9j

Jetty vulnerable to errant command quoting in CGI Servlet

Priority LOW 19

Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project.

CVSS 3.1LOW 3.5 Network Low privileges No interaction EPSS 0.01162 Published 2023-09-15 Partial fix · 9.4.52, 10.0.16 +2 CWE-149
TI-2024-14665 CVE-2024-22047 · GHSA-hjp3-5g2q-7jww

Audited Log Integrity Errors Due to Race Condition

Priority LOW 16

A race condition exists in Audited 4.0.0 before 5.3.3 that can result in an authenticated user to cause audit log entries to be attributed to another user.

CVSS 3.1LOW 3.1 Network Low privileges No interaction EPSS 0.00498 Published 2024-01-04 Fixed in 5.3.3 CWE-362