Read the docs
Red Hat Security Advisory

RHSA-2024:8906

Satellite 6.16.0 release

Released 2024-11-05 · Red Hat rating Critical · View on Red Hat →

Fixed in

Fixes 14 records

TI-2024-07345 CVE-2024-7923 · GHSA-pmjc-mxf4-8qwx

Puppet-pulpcore: an authentication bypass vulnerability exists in pulpcore

Priority MEDIUM 50

An authentication bypass vulnerability has been identified in Pulpcore when deployed with Gunicorn versions prior to 22.0, due to the puppet-pulpcore configuration.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00814 Published 2024-09-04 Fixed in 22.0, 1:3.5.2.8-1.el8sat +4 CWE-287
TI-2024-06507 CVE-2024-7012 · GHSA-gp3v-m4q9-3v8h

Puppet-foreman: an authentication bypass vulnerability exists in foreman

Priority MEDIUM 50

An authentication bypass vulnerability has been identified in Foreman when deployed with External Authentication, due to the puppet-foreman configuration.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00769 Published 2024-09-04 Fixed in 22.0, 1:3.5.2.8-1.el8sat +4 CWE-287
TI-2024-07767 CVE-2024-8376 · GHSA-72qw-2vp3-gvg9

Memory leak in Eclipse Foundation Mosquitto

Priority LOW 33

In Eclipse Mosquitto up to version 2.0.18a, an attacker can achieve memory leaking, segmentation fault or heap-use-after-free by sending specific sequences of "CONNECT", "DISCONNECT", "SUBSCRIBE", "UNSUBSCRIBE" and "PUBL…

CVSS 4.0HIGH 7.2 Network Low privileges No interaction EPSS 0.00749 Published 2024-10-11 Partial fix · 2.0.19 CWE-401
TI-2024-03787 CVE-2024-4067 · GHSA-952p-6rrq-rcjv

Regular Expression Denial of Service in micromatch

Priority LOW 33

The NPM package `micromatch` prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01429 Published 2024-05-13 Partial fix · 4.0.8 CWE-1333
TI-2024-07929 CVE-2024-8553 · GHSA-ffc7-h8x5-mm7h

Foreman: read-only access to entire db from templates

Priority LOW 28

A vulnerability was found in Foreman's loader macros introduced with report templates.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00433 Published 2024-10-31 Fixed in 3.5.1.25-1.el8sat, 3.7.0.14-1.el8sat +3 CWE-200
TI-2024-06711 CVE-2024-7246 · GHSA-ghwg-gpp4-w4x3

HPACK table poisoning in gRPC C++, Python & Ruby

Priority LOW 27

It's possible for a gRPC client communicating with a HTTP/2 proxy to poison the HPACK table between the proxy and the backend such that other clients see failed requests.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00222 Published 2024-08-06 Partial fix CWE-440
TI-2024-05174 CVE-2024-5569 · GHSA-jfmj-5v4g-7637

Denial of Service via crafted zip file in jaraco/zipp

Priority LOW 27

A Denial of Service (DoS) vulnerability exists in the jaraco/zipp library, affecting all versions prior to 3.19.1.

CVSS 3.0MEDIUM 6.2 Local No auth No interaction EPSS 0.00236 Published 2024-07-09 Partial fix · 3.19.1 CWE-835