Red Hat Security Advisory: Satellite 6.13 Release

Fixed packages 400

Vulnerabilities 26

• Critical 9.8
  CVE-2022-32224 Public exploit

  Active Record RCE bug with Serialized Columns

  A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record < 7.0.3.1, <6.1.6.1, <6.0.5.1 and <5.2.8.1 which could allow an attacker, that can manipulate data in the database (via means like SQL injection), the abilit…

  rails rails activerecord Debian Ubuntu RubyGems
  Dec 5, 2022
• Critical 9.8
  CVE-2022-33980 Public exploit EPSS 45%

  Apache Commons Configuration insecure interpolation defaults

  Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.configura…

  Apache Software Foundation Apache Commons Configuration commons-configuration2 org.apache.commons:commons-configuration2 Debian Ubuntu Maven
  Jul 6, 2022
• Critical 9.8
  CVE-2022-42889 Public exploit EPSS 100%

  Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults

  Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.String…

  Apache Software Foundation Apache Commons Text commons-text commons-text Debian Ubuntu Maven
  Oct 13, 2022
• High 8.3
  CVE-2022-1471 Public exploit EPSS 100%

  Remote Code execution in SnakeYAML

  SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrust…

  SnakeYaml SnakeYaml management-api-for-apache-cassandra-5.0 cassandra-reaper Debian Ubuntu Wolfi Maven
  Dec 1, 2022
• High 7.5
  CVE-2021-46877

  jackson-databind possible Denial of Service if using JDK serialization to serialize JsonNode

  jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB transient heap usage per read) in uncommon situations involving JsonNode JDK serialization.

  management-api-for-apache-cassandra-5.0 com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Wolfi Maven
  Mar 18, 2023
• High 7.5
  CVE-2022-23514

  Inefficient Regular Expression Complexity in Loofah

  Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah < 2.19.1 contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize cert…

  flavorjones loofah loofah ruby-loofah Debian Ubuntu RubyGems
  Dec 14, 2022
• High 7.5
  CVE-2022-23516

  Uncontrolled Recursion in Loofah

  Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah >= 2.2.0, < 2.19.1 uses recursion for sanitizing CDATA sections, making it susceptible to stack exhaustion and raising a SystemSta…

  flavorjones loofah loofah ruby-loofah Debian Ubuntu RubyGems
  Dec 14, 2022
• High 7.5
  CVE-2022-23517

  Inefficient Regular Expression Complexity in rails-html-sanitizer

  rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Certain configurations of rails-html-sanitizer < 1.4.4 use an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize cer…

  rails rails-html-sanitizer rails-html-sanitizer ruby-rails-html-sanitizer Debian Ubuntu RubyGems
  Dec 14, 2022
• High 7.5
  CVE-2022-25857

  Denial of Service (DoS)

  The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.

  management-api-for-apache-cassandra-5.0 management-api-for-apache-cassandra-5.0-compat org.yaml:snakeyaml snakeyaml Debian Ubuntu Wolfi Maven
  Aug 30, 2022
• High 7.5
  CVE-2022-31163

  TZInfo relative path traversal vulnerability allows loading of arbitrary files

  TZInfo is a Ruby library that provides access to time zone data and allows times to be converted using time zone rules. Versions prior to 0.36.1, as well as those prior to 1.2.10 when used with the Ruby data source tzinfo-data, are vulnerable to relative path…

  tzinfo tzinfo tzinfo ruby-tzinfo Debian Ubuntu RubyGems
  Jul 21, 2022
• High 7.5
  CVE-2022-41323

  Django denial-of-service vulnerability in internationalized URLs

  In Django 3.2 before 3.2.16, 4.0 before 4.0.8, and 4.1 before 4.1.2, internationalized URLs were subject to a potential denial of service attack via the locale parameter, which is treated as a regular expression.

  python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  Oct 16, 2022
• High 7.5
  CVE-2022-42003

  Uncontrolled Resource Consumption in Jackson-databind

  In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.

  management-api-for-apache-cassandra-5.0 com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Wolfi Maven
  Oct 2, 2022
• High 7.5
  CVE-2022-42004

  Uncontrolled Resource Consumption in FasterXML jackson-databind

  In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for des…

  management-api-for-apache-cassandra-5.0 com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Wolfi Maven
  Oct 2, 2022
• High 7.5
  CVE-2023-23969 EPSS 47%

  Django contains Uncontrolled Resource Consumption via cached header

  In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-service vector via excessive memory usage if the raw value o…

  python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  Feb 1, 2023
• High 7.5
  CVE-2023-24580 EPSS 63%

  Resource exhaustion in Django

  An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhausti…

  python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  Feb 15, 2023
• High 7.2
  CVE-2022-23519

  Possible XSS vulnerability with certain configurations of rails-html-sanitizer

  rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Prior to version 1.4.4, a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application deve…

  rails rails-html-sanitizer rails-html-sanitizer ruby-rails-html-sanitizer Debian Ubuntu RubyGems
  Dec 14, 2022
• Medium 6.5
  CVE-2022-38749

  DoS in SnakeYAML

  Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.

  SnakeYaml SnakeYaml management-api-for-apache-cassandra-5.0 management-api-for-apache-cassandra-5.0-compat Debian Ubuntu Wolfi Maven
  Sep 5, 2022
• Medium 6.5
  CVE-2022-38750

  DoS in SnakeYAML

  Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.

  SnakeYaml SnakeYaml management-api-for-apache-cassandra-5.0 management-api-for-apache-cassandra-5.0-compat Debian Ubuntu Wolfi Maven
  Sep 5, 2022
• Medium 6.5
  CVE-2022-38751

  DoS in SnakeYAML

  Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.

  SnakeYaml SnakeYaml management-api-for-apache-cassandra-5.0 management-api-for-apache-cassandra-5.0-compat Debian Ubuntu Wolfi Maven
  Sep 5, 2022
• Medium 6.5
  CVE-2022-38752

  DoS in SnakeYAML

  Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack-overflow.

  SnakeYaml SnakeYaml management-api-for-apache-cassandra-5.0 management-api-for-apache-cassandra-5.0-compat Debian Wolfi Maven
  Sep 5, 2022
• Medium 6.1
  CVE-2022-22577

  Cross-site Scripting Vulnerability in Action Pack

  An XSS Vulnerability in Action Pack >= 5.2.0 and < 5.2.0 that could allow an attacker to bypass CSP for non HTML like responses.

  rails rails actionpack Debian Ubuntu RubyGems
  May 26, 2022
• Medium 6.1
  CVE-2022-23515

  Improper neutralization of data URIs may allow XSS in Loofah

  Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah >= 2.1.0, < 2.19.1 is vulnerable to cross-site scripting via the image/svg+xml media type in data URIs. This issue is patched in v…

  flavorjones loofah loofah ruby-loofah Debian Ubuntu RubyGems
  Dec 14, 2022
• Medium 6.1
  CVE-2022-23518

  Improper neutralization of data URIs allows XSS in rails-html-sanitizer

  rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Versions >= 1.0.3, < 1.4.4 are vulnerable to cross-site scripting via data URIs when used in combination with Loofah >= 2.1.0. This issue is patched in version 1.4.4.

  rails rails-html-sanitizer rails-html-sanitizer ruby-rails-html-sanitizer Debian Ubuntu RubyGems
  Dec 14, 2022
• Medium 6.1
  CVE-2022-23520

  rails-html-sanitizer contains an incomplete fix for an XSS vulnerability

  rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Prior to version 1.4.4, there is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer due to an incomplete fix of CVE-2022-32209. Rails::Htm…

  rails rails-html-sanitizer rails-html-sanitizer ruby-rails-html-sanitizer Debian Ubuntu RubyGems
  Dec 14, 2022
• Medium 6.1
  CVE-2022-27777

  XSS Vulnerability in Action View tag helpers

  A XSS Vulnerability in Action View tag helpers >= 5.2.0 and < 5.2.0 which would allow an attacker to inject content if able to control input into specific attributes.

  rails rails redmine actionview Debian Ubuntu RubyGems
  May 26, 2022
• Medium 4.7
  CVE-2022-41946

  TemporaryFolder on unix-like systems does not limit access to created files in pgjdbc

  pgjdbc is an open source postgresql JDBC Driver. In affected versions a prepared statement using either `PreparedStatement.setText(int, InputStream)` or `PreparedStatemet.setBytea(int, InputStream)` will create a temporary file if the InputStream is larger th…

  pgjdbc pgjdbc libpgjava libpgjava Debian Ubuntu Alpine Maven
  Nov 23, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1225819
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1266407
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1630294
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1638226
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1650468
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1761012
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1786358
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1787456
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1813274
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1826648
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1837767
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1841534
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1845489
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1880947
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1888667
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1895976
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1920810
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1931027
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1931533
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1950468
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1952529
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1956210
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1956985
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1963266
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1964037
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1965871
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1978683
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1978995
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1990790
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1990875
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1995097
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1995470
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1997186
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1997199
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2026151
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2029402
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2032040
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2043600