Red Hat Security Advisory: Satellite 6.12.1 Async Security Update

Fixed packages 59

Vulnerabilities 3

• Critical 9.8
  CVE-2022-32224 Public exploit

  Active Record RCE bug with Serialized Columns

  A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record < 7.0.3.1, <6.1.6.1, <6.0.5.1 and <5.2.8.1 which could allow an attacker, that can manipulate data in the database (via means like SQL injection), the abilit…

  rails rails activerecord Debian Ubuntu RubyGems
  Dec 5, 2022
• Critical 9.8
  CVE-2022-42889 Public exploit EPSS 100%

  Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults

  Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.String…

  Apache Software Foundation Apache Commons Text com.guicedee.services:commons-text commons-text Debian Ubuntu Maven
  Oct 13, 2022
• High 7.5
  CVE-2022-42003

  Uncontrolled Resource Consumption in Jackson-databind

  In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.

  management-api-for-apache-cassandra-5.0 jackson-databind com.fasterxml.jackson.core:jackson-databind jackson-databind Debian Ubuntu Wolfi Maven
  Oct 2, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#critical
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2082209
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2108997
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2135435
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2141308
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2150069
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2150108
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2150111
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2150112
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2150114
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2150118
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2150119
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2150120
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2150123
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2150125
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0261.json
• report
  https://access.redhat.com/security/cve/CVE-2022-32224
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-32224
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-32224
• article
  https://discuss.rubyonrails.org/t/cve-2022-32224-possible-rce-escalation-bug-with-serialized-columns-in-active-record/81017
• report
  https://access.redhat.com/security/cve/CVE-2022-42003
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2135244
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-42003
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-42003
• report
  https://access.redhat.com/security/cve/CVE-2022-42889
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-42889
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-42889
• article
  https://blogs.apache.org/security/entry/cve-2022-42889
• article
  https://lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om
• article
  https://seclists.org/oss-sec/2022/q4/22