Red Hat Security Advisory: Satellite 6.9 Release

Fixed packages 400

Vulnerabilities 17

• Critical 9.8
  CVE-2015-1820

  rest-client Gem Vulnerable to Session Fixation

  REST client for Ruby (aka rest-client) before 1.8.0 allows remote attackers to conduct session fixation attacks or obtain sensitive cookie information by leveraging passage of cookies set in a response to a redirect.

  rest-client ruby-rest-client Debian RubyGems
  Aug 9, 2017
• Critical 9.8
  CVE-2020-8165 Public exploit EPSS 46%

  ActiveSupport potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore

  A deserialization of untrusted data vulnernerability exists in rails < 5.2.4.3, rails < 6.0.3.1 that can allow an attacker to unmarshal user-provided objects in MemCacheStore and RedisCacheStore potentially resulting in an RCE.

  rails rails activesupport Debian Ubuntu RubyGems
  Jun 19, 2020
• High 8.8
  CVE-2020-9402 EPSS 24%

  SQL injection in Django

  Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on O…

  python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  Mar 5, 2020
• High 7.5
  CVE-2019-18874

  Double Free in psutil

  psutil (aka python-psutil) through 5.6.5 can have a double free. This occurs because of refcount mishandling within a while or for loop that converts system data into a Python object.

  python-psutil python-psutil psutil python-psutil Debian Ubuntu Azure Linux Alpine PyPI
  Nov 12, 2019
• High 7.5
  CVE-2020-11612

  Denial of Service in Netty

  The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker could send a large ZlibEncoded byte stream to the Netty server, forcing the server to allocate all of its free memory to …

  netty netty io.netty:netty-handler Debian Ubuntu Maven
  Apr 7, 2020
• High 7.5
  CVE-2020-8162 Public exploit

  Circumvention of file size limits in ActiveStorage

  A client side enforcement of server side security vulnerability exists in rails < 5.2.4.2 and rails < 6.0.3.1 ActiveStorage's S3 adapter that allows the Content-Length of a direct file upload to be modified by an end user bypassing upload limits.

  rails rails activestorage Debian Ubuntu RubyGems
  Jun 19, 2020
• High 7.5
  CVE-2020-8164

  Possible Strong Parameters Bypass in ActionPack

  A deserialization of untrusted data vulnerability exists in rails < 5.2.4.3, rails < 6.0.3.1 which can allow an attacker to supply information can be inadvertently leaked fromStrong Parameters.

  rails rails actionpack Debian Ubuntu RubyGems
  Jun 19, 2020
• Medium 6.5
  CVE-2020-8167

  CSRF Vulnerability in rails-ujs

  A CSRF vulnerability exists in rails <= 6.0.3 rails-ujs module that could allow attackers to send CSRF tokens to wrong domains.

  rails rails actionview Debian Ubuntu RubyGems
  Jun 19, 2020
• Medium 6.5
  CVE-2020-8185

  Untrusted users can run pending migrations in production in Rails

  A denial of service vulnerability exists in Rails <6.0.3.2 that allowed an untrusted user to run any pending migrations on a Rails app running in production.

  rails actionpack Ubuntu RubyGems
  Jul 2, 2020
• Medium 6.3
  CVE-2019-16782

  Possible Information Leak / Session Hijack Vulnerability in Rack

  There's a possible information leak / session hijack vulnerability in Rack (RubyGem rack). This vulnerability is patched in versions 1.6.12 and 2.0.8. Attackers may be able to find and hijack sessions by using timing attacks targeting the session id. Session …

  rack rack rack ruby-rack Debian Ubuntu RubyGems
  Dec 18, 2019
• Medium 5.9
  CVE-2018-1000119

  rack-protection gem timing attack vulnerability when validating CSRF token

  Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby applicat…

  rack-protection ruby-rack-protection Ubuntu RubyGems
  Mar 7, 2018
• Medium 5.4
  CVE-2020-15169 Public exploit

  XSS in Action View

  In Action View before versions 5.2.4.4 and 6.0.3.3 there is a potential Cross-Site Scripting (XSS) vulnerability in Action View's translation helpers. Views that allow the user to control the default (not found) value of the `t` and `translate` helpers could …

  rails actionview rails rails Debian Ubuntu RubyGems
  Sep 11, 2020
• Medium 5.3
  CVE-2020-25633

  Generation of Error Message Containing Sensitive Information in RESTEasy client

  A flaw was found in RESTEasy client in all versions of RESTEasy up to 4.5.6.Final. It may allow client users to obtain the server's potentially sensitive information when the server got WebApplicationException from the RESTEasy client call. The highest threat…

  Red Hat resteasy-client resteasy resteasy3.0 Debian Ubuntu Maven
  Sep 18, 2020
• Medium 4.3
  CVE-2017-2662

  katello Improper Privilege Management vulnerability

  A flaw was found in Foreman's katello plugin version 3.4.5. After setting a new role to allow restricted access on a repository with a filter (filter set on the Product Name), the filter is not respected when the actions are done via hammer using the reposito…

  The Foreman Project foreman katello plugin katello RubyGems
  Aug 22, 2018
• Medium 4.3
  CVE-2020-8166

  Ability to forge per-form CSRF tokens in Rails

  A CSRF forgery vulnerability exists in rails < 5.2.5, rails < 6.0.4 that makes it possible for an attacker to, given a global CSRF token such as the one present in the authenticity_token meta tag, forge a per-form CSRF token.

  rails rails actionpack Debian Ubuntu RubyGems
  Jul 2, 2020
• Low —
  CVE-2015-3448

  rest-client allows local users to obtain sensitive information by reading the log

  REST client for Ruby (aka rest-client) before 1.7.3 logs usernames and passwords, which allows local users to obtain sensitive information by reading the log.

  rest-client ruby-rest-client Debian RubyGems
  Apr 29, 2015
• Unscored —
  CVE-2020-14335

  A flaw was found in Red Hat Satellite, which allows a privileged attacker to read OMAPI secrets through the ISC DHCP of…

  Jun 2, 2021

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1434106
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1439842
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1459807
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1470083
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1526564
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1531536
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1627812
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1654576
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1659506
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1662478
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1667647
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1677180
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1686641
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1686691
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1690550
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1694868
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1698395
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1699188
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1701075
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1722799
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1725817
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1726288
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1726293
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1741943
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1746218
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1747515
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1752492
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1752914
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1754497
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1762346
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1767040
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1772014
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1772526
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1772781
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1774378
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1776470
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1777293
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1781469