Red Hat Security Advisory: Satellite 6.8 release

Fixed packages 400

Vulnerabilities 28

• Critical 9.8
  CVE-2020-8840 Public exploit EPSS 27%

  Deserialization of Untrusted Data in jackson-databind

  FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.

  jackson-databind com.fasterxml.jackson.core:jackson-databind jackson-databind Debian Ubuntu Maven
  Feb 10, 2020
• Critical 9.8
  CVE-2020-9546

  jackson-databind mishandles the interaction between serialization gadgets and typing

  FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).

  com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven
  Mar 2, 2020
• Critical 9.8
  CVE-2020-9547 Public exploit Scanner template EPSS 18%

  jackson-databind mishandles the interaction between serialization gadgets and typing

  FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).

  com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven
  Mar 2, 2020
• Critical 9.8
  CVE-2020-9548 Public exploit Scanner template EPSS 19%

  jackson-databind mishandles the interaction between serialization gadgets and typing

  FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).

  com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven
  Mar 2, 2020
• High 8.8
  CVE-2018-3258

  Improper Privilege Management in MySQL Connectors Java

  Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 8.0.12 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols …

  Oracle MySQL Connectors mysql:mysql-connector-java Maven
  Oct 17, 2018
• High 8.8
  CVE-2020-10968

  jackson-databind mishandles the interaction between serialization gadgets and typing

  FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider (aka bus-proxy).

  com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven
  Mar 26, 2020
• High 8.8
  CVE-2020-10969

  jackson-databind mishandles the interaction between serialization gadgets and typing

  FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane.

  jackson-databind com.fasterxml.jackson.core:jackson-databind jackson-databind Debian Ubuntu Maven
  Mar 26, 2020
• High 8.6
  CVE-2020-8161

  Directory traversal in Rack::Directory app bundled with Rack

  A directory traversal vulnerability exists in rack < 2.2.0 that allows an attacker perform directory traversal vulnerability in the Rack::Directory app that is bundled with Rack which could result in information disclosure.

  rack ruby-rack ruby-rack Debian Ubuntu RubyGems
  Jul 2, 2020
• High 8.2
  CVE-2020-7663

  Regular Expression Denial of Service in websocket-extensions (RubyGem)

  websocket-extensions ruby module prior to 0.1.5 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte seque…

  websocket-extensions ruby-websocket-extensions ruby-websocket-extensions Debian Ubuntu RubyGems
  Jun 2, 2020
• High 8.1
  CVE-2020-11619

  jackson-databind mishandles the interaction between serialization gadgets and typing

  FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka spring-aop).

  com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven
  Apr 7, 2020
• High 8.1
  CVE-2020-14061

  Deserialization of untrusted data in Jackson Databind

  FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQjmsQueueConnectionFactory, oracle.jms.AQjmsXATopicConnectionFactory, oracle.jms.AQjmsTopicConnectionFactory, oracle.jms…

  com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven
  Jun 14, 2020
• High 8.1
  CVE-2020-14062

  Deserialization of untrusted data in Jackson Databind

  FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool (aka xalan2).

  jackson-databind com.fasterxml.jackson.core:jackson-databind jackson-databind Debian Ubuntu Maven
  Jun 14, 2020
• High 8.1
  CVE-2020-14195 Public exploit

  Deserialization of untrusted data in Jackson Databind

  FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory (aka org.jsecurity).

  com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven
  Jun 16, 2020
• High 7.5
  CVE-2020-7238

  HTTP Request Smuggling in Netty

  Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exists because of an incomplete fix for CVE-2019-16869.

  netty netty io.netty:netty-handler netty-3.9 Debian Ubuntu Maven
  Jan 27, 2020
• High 7.5
  CVE-2020-8184

  Rack allows Percent-encoded cookies to overwrite existing prefixed cookie names

  A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 that makes it is possible for an attacker to forge a secure or host-only cookie prefix.

  rack ruby-rack ruby-rack Debian Ubuntu RubyGems
  Jun 19, 2020
• Medium 6.5
  CVE-2019-10219 Public exploit

  The SafeHtml annotation in Hibernate-Validator does not properly guard against XSS attacks

  A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.

  Hibernate hibernate-validator libhibernate-validator-java org.hibernate:hibernate-validator Debian Ubuntu Maven
  Nov 8, 2019
• Medium 6.5
  CVE-2020-7942

  Improper Certificate Validation in Puppet

  Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in the system and that a compromised certificate allowed access to everything in the infrastructure. When a node's catalog falls back to the `default` …

  Puppet Puppet Agent Puppet puppet Debian RubyGems
  Feb 19, 2020
• Medium 6.3
  CVE-2019-16782

  Possible Information Leak / Session Hijack Vulnerability in Rack

  There's a possible information leak / session hijack vulnerability in Rack (RubyGem rack). This vulnerability is patched in versions 1.6.12 and 2.0.8. Attackers may be able to find and hijack sessions by using timing attacks targeting the session id. Session …

  rack rack rack ruby-rack Debian Ubuntu RubyGems
  Dec 18, 2019
• Medium 5.9
  CVE-2018-1000119

  rack-protection gem timing attack vulnerability when validating CSRF token

  Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby applicat…

  rack-protection ruby-rack-protection Ubuntu RubyGems
  Mar 7, 2018
• Medium 5.3
  CVE-2019-12781

  Django Incorrect HTTP detection with reverse-proxy connecting via HTTPS

  An issue was discovered in Django 1.11 before 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3. An HTTP request is not redirected to HTTPS when the SECURE_PROXY_SSL_HEADER and SECURE_SSL_REDIRECT settings are used, and the proxy connects to Django via HTTPS. …

  python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  Jul 1, 2019
• Medium 5.3
  CVE-2020-10693

  Improper Input Validation in Hibernate Validator

  A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows attackers to bypass input sanitation (escaping, stripping) control…

  Hibernate hibernate-validator libhibernate-validator-java org.hibernate:hibernate-validator Debian Ubuntu Maven
  May 6, 2020
• Medium 4.4
  CVE-2020-5216

  Limited header injection when using dynamic overrides with user input in RubyGems secure_headers

  In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.9.0, 5.2.0, and 6.3.0. If user-supplied input was passed into append/override_content_security_policy_directives, a newline could be injected leadi…

  Twitter secure_headers secure_headers ruby-secure-headers Debian Ubuntu RubyGems
  Jan 23, 2020
• Medium 4.4
  CVE-2020-5217

  Directive injection when using dynamic overrides with user input in RubyGems secure_headers

  In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.8.0, 5.1.0, and 6.2.0. If user-supplied input was passed into append/override_content_security_policy_directives, a semicolon could be injected lea…

  Twitter secure_headers secure_headers ruby-secure-headers Debian Ubuntu RubyGems
  Jan 23, 2020
• Medium 4.0
  CVE-2020-5267 Public exploit

  Possible XSS vulnerability in ActionView

  In ActionView before versions 6.0.2.2 and 5.2.4.2, there is a possible XSS vulnerability in ActionView's JavaScript literal escape helpers. Views that use the `j` or `escape_javascript` methods may be susceptible to XSS attacks. The issue is fixed in versions…

  rails actionview rails rails Debian Ubuntu RubyGems
  Mar 19, 2020
• Unscored —
  CVE-2018-11751

  Previous versions of Puppet Agent didn't verify the peer in the SSL connection prior to downloading the CRL. This issue…

  Dec 16, 2019
• Unscored —
  CVE-2020-14334

  A flaw was found in Red Hat Satellite 6 which allows privileged attacker to read cache files. These cache credentials c…

  Jul 31, 2020
• Unscored —
  CVE-2020-14380

  An account takeover flaw was found in Red Hat Satellite 6.7.2 onward. A potential attacker with proper authentication t…

  Jun 2, 2021
• Unscored —
  CVE-2020-7943 Scanner template

  Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints. For Pu…

  puppet puppetdb puppetdb Debian Ubuntu
  Mar 11, 2020

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1160344
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1261802
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1300211
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1332702
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1398317
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1410616
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1410916
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1429033
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1461781
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1469267
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1486446
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1486696
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1494180
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1501499
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1503037
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1505842
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1531674
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1537320
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1543316
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1563270
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1569324
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1571907
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1576859
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1584184
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1601101
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1607706
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1608001
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1613391
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1619274
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1619422
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1620214
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1624049
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1625258
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1627066
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1630433
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1630536
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1632577
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1640615