Read the docs
Red Hat Security Advisory

RHSA-2026:95656

Satellite 6.17 security update

Released 2026-11-05 · Red Hat rating Critical · View on Red Hat →

Fixed in

Fixes 41 records

TI-2026-71508 CVE-2026-97229 · GHSA-9hj5-r43h-h3xg

Integer overflow in GitLab allows code execution on the server

Priority CRITICAL 100KEV

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to exec…

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.6522 Published 2026-10-13 Partial fix · 19.2.8, 19.3.5 +1 CWE-190
TI-2026-79288 CVE-2026-111497 · GHSA-9v8h-qqgm-4m35

Out-of-bounds write in Google Brotli decoder

Priority CRITICAL 99KEV

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, dis…

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.82641 Published 2026-10-22 Partial fix · 1.0.10, 1.1.1 +2 CWE-252
TI-2026-74549 CVE-2026-110859

Argument injection in GitPython Head.checkout() leaks arbitrary files

Priority HIGH 77

GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout() that allows remote attackers to read arbitrary files by supplying a branch name parsed as a git option.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00387 Published 2026-10-14 Partial fix · 3.2.0 CWE-88
TI-2026-74546 CVE-2026-110856

Regular expression denial of service in GitPython author parsing

Priority HIGH 77

GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the _re_actor_epoch pattern used by parse_actor_and_date on author, committer, and tagger lines.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00337 Published 2026-10-14 Partial fix · 3.2.0 CWE-1333
TI-2026-54689 CVE-2026-78677 · GHSA-8mcc-hrx5-hvxc

GitPython before 3.1.59 Path Traversal via separate-git-dir

Priority HIGH 77

GitPython before 3.1.59 omits --separate-git-dir from unsafe_git_clone_options, allowing attackers to create arbitrary git directories outside the intended clone destination.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00651 Published 2026-08-25 Partial fix · 3.1.59 CWE-22
TI-2026-51703 CVE-2026-73619 · GHSA-m3x4-5jfw-2mqc

GitPython before 3.1.57 Arbitrary File Read via Repo.archive()

Priority MEDIUM 64

GitPython before 3.1.57 contains an incomplete denylist in the unsafe_git_archive_options guard that omits --add-file and --add-virtual-file options.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00412 Published 2026-08-13 Partial fix · 3.1.57 CWE-73
TI-2026-79139 CVE-2026-110264 · GHSA-83vq-rvff-66gw

Integer overflow in GitLab regex compilation allows code execution

Priority MEDIUM 52

An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 th…

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.01349 Published 2026-10-22 Partial fix · 18.11.13, 19.0.10 +5 CWE-190
TI-2026-63046 CVE-2026-93577 · GHSA-wqwg-376r-c226

Integer Overflow or Wraparound in GitLab

Priority MEDIUM 44

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute…

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.0063 Published 2026-09-23 Partial fix · 19.2.7, 19.3.3 +1 CWE-190
TI-2026-59936 CVE-2026-87819 · GHSA-g5vv-9gxw-82hx

GitPython before 3.1.60 Denial of Service via ReDoS

Priority MEDIUM 44

GitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.name_email_regex that processes commit author and committer fields.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00521 Published 2026-09-09 Partial fix · 3.1.60 CWE-1333
TI-2026-84577 CVE-2026-115731 · GHSA-4pxx-8frq-9r4j

Untrusted deserialization in Puppet Enterprise allows code execution

Priority MEDIUM 43

Deserialization of untrusted data in the report-processing code of Puppet, as used by Puppet Server, in the affected releases, allows a client that holds any CA-signed agent certificate to execute arbitrary code on the P…

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.00366 Published 2026-11-03 Partial fix · 2023.8.13, 2025.12.1 +1 CWE-502
TI-2026-60363 CVE-2026-89078 · GHSA-9chr-4x58-948m

Double Free in GitLab

Priority MEDIUM 43

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute…

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00522 Published 2026-09-23 Partial fix · 19.2.7, 19.3.3 +1 CWE-415
TI-2026-84571 CVE-2026-115732 · GHSA-5jqj-9p78-vmh3

Certificate name authorization bypass in Puppet Enterprise

Priority MEDIUM 42

Incorrect authorization in the certificate-name matching of trapperkeeper-authorization, as used by Puppet Server, in the affected products, allows a client that holds a CA-signed certificate whose name extends or shorte…

CVSS 4.0CRITICAL 9.0 Network Low privileges No interaction EPSS 0.00745 Published 2026-11-03 Partial fix · 2023.8.13, 2025.12.1 +1 CWE-697
TI-2026-74548 CVE-2026-110858

Command injection in GitPython Remote.pull() allows code execution

Priority MEDIUM 42

GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull() whose unsafe-option guard inspects only keyword arguments, not the positional refspec.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00465 Published 2026-10-14 Partial fix · 3.2.0 CWE-88
TI-2026-81634 CVE-2026-104895

Unbounded allocation in jackson-dataformat-smile async parser

Priority LOW 39

The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] before the body is read, with no upper bound and no overflow check.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0038 Published 2026-10-28 Partial fix · 2.18.12, 2.21.8 +3 CWE-789
TI-2026-74547 CVE-2026-110857

Remote code execution in GitPython via ls_remote ext:: URLs

Priority LOW 36

GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run commands because Git.ls_remote forwards URLs without check_unsafe_protocols validation.

CVSS 4.0HIGH 7.7 Network No auth User interaction EPSS 0.00417 Published 2026-10-14 Partial fix · 3.2.0 CWE-1287