Red Hat Security Advisory: Satellite 6.11.5 Async Security Update

Fixed packages 124

Vulnerabilities 2

• Critical 9.8
  CVE-2022-32224 Public exploit

  Active Record RCE bug with Serialized Columns

  A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record < 7.0.3.1, <6.1.6.1, <6.0.5.1 and <5.2.8.1 which could allow an attacker, that can manipulate data in the database (via means like SQL injection), the abilit…

  rails rails activerecord Debian Ubuntu RubyGems
  Dec 5, 2022
• High 7.5
  CVE-2022-42003

  Uncontrolled Resource Consumption in Jackson-databind

  In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.

  management-api-for-apache-cassandra-5.0 com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Wolfi Maven
  Oct 2, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#critical
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2108997
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2153877
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2161929
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2166747
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2166748
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2166749
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2166750
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2166756
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2166757
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2166759
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2166760
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2166761
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2166762
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2170874
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1151.json
• report
  https://access.redhat.com/security/cve/CVE-2022-32224
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-32224
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-32224
• article
  https://discuss.rubyonrails.org/t/cve-2022-32224-possible-rce-escalation-bug-with-serialized-columns-in-active-record/81017
• report
  https://access.redhat.com/security/cve/CVE-2022-42003
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2135244
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-42003
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-42003