Red Hat Security Advisory: Satellite 6.11 Release

Fixed packages 35

Vulnerabilities 28

• Critical 9.8
  CVE-2022-28346 Public exploit EPSS 19%

  SQL Injection in Django

  An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a crafted dictionary (with dictionary expansion) as the pass…

  python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  Apr 12, 2022
• Critical 9.8
  CVE-2022-28347

  SQL Injection in Django

  A SQL injection issue was discovered in QuerySet.explain() in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. This occurs by passing a crafted dictionary (with dictionary expansion) as the **options argument, and placing the injection paylo…

  python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  Apr 12, 2022
• High 8.2
  CVE-2021-43818

  HTML Cleaner allows crafted and SVG embedded scripts to pass through

  lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs. Users that employ th…

  lxml lxml lxml lxml Debian Ubuntu Azure Linux Alpine PyPI
  Dec 13, 2021
• High 8.0
  CVE-2022-23634

  Information Exposure when using Puma with Rails

  Puma is a Ruby/Rack web server built for parallelism. Prior to `puma` version `5.6.2`, `puma` may not always call `close` on the response body. Rails, prior to version `7.0.2.2`, depended on the response body being closed in order for its `CurrentAttributes` …

  puma puma puma puma Debian Ubuntu RubyGems
  Feb 11, 2022
• High 7.5
  CVE-2021-32839

  Regular Expression Denial of Service in sqlparse

  sqlparse is a non-validating SQL parser module for Python. In sqlparse versions 0.4.0 and 0.4.1 there is a regular Expression Denial of Service in sqlparse vulnerability. The regular expression may cause exponential backtracking on strings containing many rep…

  andialbrecht sqlparse sqlparse sqlparse Debian Ubuntu Alpine PyPI
  Sep 20, 2021
• High 7.5
  CVE-2021-45115

  Denial-of-service in Django

  An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. UserAttributeSimilarityValidator incurred significant overhead in evaluating a submitted password that was artificially large in relation to the comparison values. I…

  python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  Jan 4, 2022
• High 7.5
  CVE-2021-45116

  Information disclosure in Django

  An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Due to leveraging the Django Template Language's variable resolution logic, the dictsort template filter was potentially vulnerable to information disclosure, or an …

  python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  Jan 4, 2022
• High 7.5
  CVE-2022-23833 EPSS 50%

  Infinite Loop in Django

  An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2. Passing certain inputs to multipart forms could result in an infinite loop when parsing files.

  python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  Feb 3, 2022
• High 7.5
  CVE-2022-23837

  Denial of service in sidekiq

  In api.rb in Sidekiq before 5.2.10 and 6.4.0, there is no limit on the number of days when requesting stats for the graph. This overloads the system, affecting the Web UI, and makes it unavailable to users.

  sidekiq ruby-sidekiq ruby-sidekiq Debian Ubuntu RubyGems
  Jan 21, 2022
• High 7.4
  CVE-2022-23633

  Exposure of sensitive information in Action Pack

  Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local stat…

  rails rails rails rails Debian Ubuntu RubyGems
  Feb 11, 2022
• High 7.3
  CVE-2021-44420

  Potential bypass of an upstream access control based on URL paths in Django

  In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths.

  python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  Dec 7, 2021
• Medium 6.6
  CVE-2021-42550

  RCE from attacker with configuration edit priviledges through JNDI lookup

  In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP servers.

  QOS.ch logback logback logback Debian Ubuntu Maven
  Dec 16, 2021
• Medium 6.5
  CVE-2021-43797

  HTTP fails to validate against control chars in header names which may lead to HTTP request smuggling

  Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the …

  netty netty netty netty Debian Ubuntu Maven
  Dec 9, 2021
• Medium 6.2
  CVE-2021-21290

  Local Information Disclosure Vulnerability in Netty on Unix-Like systems due temporary files

  Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty before version 4.1.59.Final there is a vulnerability on Unix-like systems involving an…

  netty netty netty netty Debian Ubuntu Maven
  Feb 8, 2021
• Medium 6.1
  CVE-2021-30151 Scanner template

  Cross-site Scripting in Sidekiq

  Sidekiq through 5.1.3 and 6.x through 6.2.0 allows XSS via the queue name of the live-poll feature when Internet Explorer is used.

  sidekiq ruby-sidekiq ruby-sidekiq Debian Ubuntu RubyGems
  Apr 6, 2021
• Medium 6.1
  CVE-2022-22818 Public exploit

  Cross-site Scripting in Django

  The {% debug %} template tag in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2 does not properly encode the current context. This may lead to XSS.

  python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  Feb 3, 2022
• Medium 5.9
  CVE-2021-21295 EPSS 19%

  Possible request smuggling in HTTP/2 due missing validation

  Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.60.Final there is a vulnerability that…

  netty io.netty:netty-codec-http2 netty netty Debian Ubuntu Maven
  Mar 9, 2021
• Medium 5.9
  CVE-2021-21409

  Possible request smuggling in HTTP/2 due missing validation of content-length

  Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there is a vulnerability that…

  netty netty netty netty Debian Ubuntu Maven
  Mar 30, 2021
• Medium 5.3
  CVE-2021-45452

  Directory-traversal in Django

  Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it.

  python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  Jan 4, 2022
• Low 3.7
  CVE-2021-41136

  Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in puma

  Puma is a HTTP 1.1 server for Ruby/Rack applications. Prior to versions 5.5.1 and 4.3.9, using `puma` with a proxy which forwards HTTP header values which contain the LF character could allow HTTP request smugggling. A client could smuggle a request through a…

  puma puma puma puma Debian RubyGems
  Oct 12, 2021
• Unscored —
  CVE-2021-3200

  Buffer overflow vulnerability in libsolv 2020-12-13 via the Solver * testcase_read(Pool *pool, FILE *fp, const char *te…

  libsolv libsolv Debian Ubuntu
  May 18, 2021
• Unscored —
  CVE-2021-33928

  Buffer overflow vulnerability in function pool_installable in src/repo.h in libsolv before 0.7.17 allows attackers to c…

  libsolv libsolv Debian Ubuntu
  Sep 2, 2021
• Unscored —
  CVE-2021-33929

  Buffer overflow vulnerability in function pool_disabled_solvable in src/repo.h in libsolv before 0.7.17 allows attacker…

  libsolv libsolv Debian Ubuntu
  Sep 2, 2021
• Unscored —
  CVE-2021-33930

  Buffer overflow vulnerability in function pool_installable_whatprovides in src/repo.h in libsolv before 0.7.17 allows a…

  libsolv libsolv Debian Ubuntu
  Sep 2, 2021
• Unscored —
  CVE-2021-33938

  Buffer overflow vulnerability in function prune_to_recommended in src/policy.c in libsolv before 0.7.17 allows attacker…

  libsolv libsolv Debian Ubuntu
  Sep 2, 2021
• Unscored —
  CVE-2021-3584

  A server side remote code execution vulnerability was found in Foreman project. A authenticated attacker could use Send…

  Dec 23, 2021
• Unscored —
  CVE-2021-4142

  The Candlepin component of Red Hat Satellite was affected by an improper authentication flaw. Few factors could allow a…

  Aug 24, 2022
• Unscored —
  CVE-2021-44568

  Two heap-overflow vulnerabilities exist in openSUSE/libsolv libsolv through 13 Dec 2020 in the decisionmap variable via…

  libsolv libsolv Debian Ubuntu
  Feb 21, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-us/red_hat_satellite/6.11/html/release_notes
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1459231
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1473263
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1545000
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1596004
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1609543
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1659649
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1662924
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1685708
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1693733
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1694659
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1713401
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1723632
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1723751
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1735540
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1744521
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1761421
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1770075
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1771724
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1777820
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1784254
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1805028
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1807258
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1807536
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1809769
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1811166
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1813624
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1819309
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1825761
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1832858
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1844848
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1845471
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1847825
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1851808
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1852897
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1862140
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1867193
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1869351