Skip to content
OpenAdvisories
Critical RHSA-2022:8506 10 CVEs

Red Hat Security Advisory: Satellite 6.12 Release

Published Sep 29, 2024 · Updated Oct 13, 2026

Ecosystem: Red Hat

Fixed packages 34

ReleasePackageFixed in
Red Hat · Satellite Capsule 6 satellite_capsule:6.12::el8 foreman 0:3.3.0.17-1.el8sat
Red Hat · Satellite Capsule 6 satellite_capsule:6.12::el8 foreman-debug 0:3.3.0.17-1.el8sat
Red Hat · Satellite Capsule 6 satellite_capsule:6.12::el8 python-django 0:3.2.14-2.el8pc
Red Hat · Satellite Capsule 6 satellite_capsule:6.12::el8 python39-django 0:3.2.14-2.el8pc
Red Hat · Satellite Capsule 6 satellite_capsule:6.12::el8 rubygem-nokogiri 0:1.13.8-1.el8sat
Red Hat · Satellite Capsule 6 satellite_capsule:6.12::el8 rubygem-nokogiri-debuginfo 0:1.13.8-1.el8sat
Red Hat · Satellite Capsule 6 satellite_capsule:6.12::el8 rubygem-nokogiri-debugsource 0:1.13.8-1.el8sat
Red Hat · Satellite Capsule 6 satellite_capsule:6.12::el8 rubygem-sinatra 1:2.2.0-1.el8sat
Red Hat · Satellite Utils 6 satellite_utils:6.12::el8 foreman 0:3.3.0.17-1.el8sat
Red Hat · Satellite Utils 6 satellite_utils:6.12::el8 foreman-cli 0:3.3.0.17-1.el8sat
Red Hat · Satellite 6 satellite:6.12::el8 candlepin 0:4.1.15-1.el8sat
Red Hat · Satellite 6 satellite:6.12::el8 candlepin-selinux 0:4.1.15-1.el8sat
Red Hat · Satellite 6 satellite:6.12::el8 foreman 0:3.3.0.17-1.el8sat
Red Hat · Satellite 6 satellite:6.12::el8 foreman-cli 0:3.3.0.17-1.el8sat
Red Hat · Satellite 6 satellite:6.12::el8 foreman-debug 0:3.3.0.17-1.el8sat
Red Hat · Satellite 6 satellite:6.12::el8 foreman-dynflow-sidekiq 0:3.3.0.17-1.el8sat
Red Hat · Satellite 6 satellite:6.12::el8 foreman-ec2 0:3.3.0.17-1.el8sat
Red Hat · Satellite 6 satellite:6.12::el8 foreman-gce 0:3.3.0.17-1.el8sat
Red Hat · Satellite 6 satellite:6.12::el8 foreman-journald 0:3.3.0.17-1.el8sat
Red Hat · Satellite 6 satellite:6.12::el8 foreman-libvirt 0:3.3.0.17-1.el8sat
Red Hat · Satellite 6 satellite:6.12::el8 foreman-openstack 0:3.3.0.17-1.el8sat
Red Hat · Satellite 6 satellite:6.12::el8 foreman-ovirt 0:3.3.0.17-1.el8sat
Red Hat · Satellite 6 satellite:6.12::el8 foreman-postgresql 0:3.3.0.17-1.el8sat
Red Hat · Satellite 6 satellite:6.12::el8 foreman-service 0:3.3.0.17-1.el8sat
Red Hat · Satellite 6 satellite:6.12::el8 foreman-telemetry 0:3.3.0.17-1.el8sat
Red Hat · Satellite 6 satellite:6.12::el8 foreman-vmware 0:3.3.0.17-1.el8sat
Red Hat · Satellite 6 satellite:6.12::el8 python-django 0:3.2.14-2.el8pc
Red Hat · Satellite 6 satellite:6.12::el8 python39-django 0:3.2.14-2.el8pc
Red Hat · Satellite 6 satellite:6.12::el8 rubygem-git 0:1.11.0-1.el8sat
Red Hat · Satellite 6 satellite:6.12::el8 rubygem-nokogiri 0:1.13.8-1.el8sat
Red Hat · Satellite 6 satellite:6.12::el8 rubygem-nokogiri-debuginfo 0:1.13.8-1.el8sat
Red Hat · Satellite 6 satellite:6.12::el8 rubygem-nokogiri-debugsource 0:1.13.8-1.el8sat
Red Hat · Satellite 6 satellite:6.12::el8 rubygem-rails-html-sanitizer 0:1.4.3-2.el8sat
Red Hat · Satellite 6 satellite:6.12::el8 rubygem-sinatra 1:2.2.0-1.el8sat

Vulnerabilities 10

  • Critical 9.8
    CVE-2022-34265 Public exploit EPSS 74%

    Django `Trunc()` and `Extract()` database functions vulnerable to SQL Injection

    An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untrusted data is used as a kind/lookup_name value. Applications that constrain the lookup name and kind cho…

    python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  • High 8.2
    CVE-2022-29181

    Improper Handling of Unexpected Data Type in Nokogiri

    Nokogiri is an open source XML and HTML library for Ruby. Nokogiri prior to version 1.13.6 does not type-check all inputs into the XML and HTML4 SAX parsers, allowing specially crafted untrusted inputs to cause illegal memory access errors (segfault) or reads…

    sparklemotion nokogiri nokogiri ruby-nokogiri Debian Ubuntu Alpine RubyGems
  • High 8.1
    CVE-2022-25648

    Command Injection

    The package git before 1.11.0 are vulnerable to Command Injection via git argument injection. When calling the fetch(remote = 'origin', opts = {}) function, the remote parameter is passed to the git fetch subcommand in a way that additional flags can be set. …

    git ruby-git ruby-git Debian Ubuntu RubyGems
  • High 7.5
    CVE-2021-37136

    Bzip2Decoder doesn't allow setting size restrictions for decompressed data

    The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and…

    The Netty project Netty druid netty Debian Ubuntu Wolfi Maven
  • High 7.5
    CVE-2021-37137

    SnappyFrameDecoder doesn't restrict chunk length any may buffer skippable chunks in an unnecessary way

    The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vu…

    The Netty project Netty druid netty Debian Ubuntu Wolfi Maven
  • High 7.5
    CVE-2022-24836

    Inefficient Regular Expression Complexity in Nokogiri

    Nokogiri is an open source XML and HTML library for Ruby. Nokogiri `< v1.13.4` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents. Users are advised to upgrade to Nokog…

    sparklemotion nokogiri nokogiri ruby-nokogiri Debian Ubuntu Alpine RubyGems
  • High 7.5
    CVE-2022-29970

    sinatra does not validate expanded path matches

    Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files.

    sinatra ruby-sinatra ruby-sinatra Debian Ubuntu RubyGems
  • High 7.5
    CVE-2024-6861

    Foreman: foreman: oauth secret exposure via unauthenticated access to the graphql api

    A disclosure of sensitive information flaw was found in foreman via the GraphQL API. If the introspection feature is enabled, it is possible for attackers to retrieve sensitive admin authentication keys which could result in a compromise of the entire product…

    Red Hat Red Hat Satellite 6 Red Hat Satellite 6.12 for RHEL 8
  • Medium 6.1
    CVE-2022-22818 Public exploit

    Cross-site Scripting in Django

    The {% debug %} template tag in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2 does not properly encode the current context. This may lead to XSS.

    python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  • Medium 6.1
    CVE-2022-32209 EPSS 27%

    Rails::Html::Sanitizer vulnerable to Cross-site Scripting

    # Possible XSS Vulnerability in Rails::Html::SanitizerThere is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.This vulnerability has been assigned the CVE identifier CVE-2022-32209.Versions Affected: ALLNot affected: NONEFi…

    rails-html-sanitizer ruby-rails-html-sanitizer ruby-rails-html-sanitizer Debian Ubuntu RubyGems

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1309740
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1703496
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1732590
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1775813
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1829468
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1830968
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1834897
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1850393
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1868175
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1868323
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1870816
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1879811
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1884148
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1892218
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1892752
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1894033
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1908841
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1912941
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1925165
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1930577
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1931532
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1931665
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1934210
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1938092
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1940396
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1951542
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1952939
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1959136
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1962253
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1964080
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1970132
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1970623
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1971747
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1973329
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1974180
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1981444
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1982698
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1982745