Skip to content
OpenAdvisories
Critical 1 exploited CVE RHSA-2023:5982 5 CVEs

Red Hat Security Advisory: Red Hat Satellite Client security and bug fix update

Published Oct 2, 2024 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 10

ReleasePackageFixed in
Red Hat · Rhel Satellite Client 6 rhel_satellite_client:6::el6 puppet-agent 0:7.26.0-3.el6sat
Red Hat · Rhel Satellite Client 6 rhel_satellite_client:6::el7 foreman_ygg_worker 0:0.2.2-1.el7sat
Red Hat · Rhel Satellite Client 6 rhel_satellite_client:6::el7 puppet-agent 0:7.26.0-3.el7sat
Red Hat · Rhel Satellite Client 6 rhel_satellite_client:6::el7 yggdrasil 0:0.2.3-1.el7sat
Red Hat · Rhel Satellite Client 6 rhel_satellite_client:6::el8 foreman_ygg_worker 0:0.2.2-1.el8sat
Red Hat · Rhel Satellite Client 6 rhel_satellite_client:6::el8 puppet-agent 0:7.26.0-3.el8sat
Red Hat · Rhel Satellite Client 6 rhel_satellite_client:6::el8 yggdrasil 0:0.2.3-1.el8sat
Red Hat · Rhel Satellite Client 6 rhel_satellite_client:6::el9 foreman_ygg_worker 0:0.2.2-1.el9sat
Red Hat · Rhel Satellite Client 6 rhel_satellite_client:6::el9 puppet-agent 0:7.26.0-3.el9sat
Red Hat · Rhel Satellite Client 6 rhel_satellite_client:6::el9 yggdrasil 0:0.2.3-1.el9sat

Vulnerabilities 5

  • High 7.5
    CVE-2023-44487 Exploited Public exploit EPSS 100%

    HTTP/2 Stream Cancellation Attack

    The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

    nodejs golang go kubescape Debian Ubuntu Azure Linux Alpine Wolfi Maven Go SwiftURL
    KEV Oct 10, 2023
  • Critical 9.8
    CVE-2022-1292 Public exploit EPSS 83%

    The c_rehash script allows command injection

    The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitra…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2022-2068 EPSS 96%

    The c_rehash script allows command injection

    In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2023-39325 Public exploit

    HTTP/2 rapid reset can cause excessive work in net/http

    A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress requ…

    Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Medium 5.3
    CVE-2022-41717 Public exploit

    Excessive memory growth in net/http and golang.org/x/net/http2

    An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large…

    Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • article
    https://access.redhat.com/documentation/en-us/red_hat_satellite/6.13/html/upgrading_and_updating_red_hat_satellite/index
  • article
    https://access.redhat.com/security/vulnerabilities/RHSB-2023-003
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2081494
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2097310
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2161274
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2184996
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2217079
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2242803
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2243296
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5982.json
  • report
    https://access.redhat.com/security/cve/CVE-2022-1292
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-1292
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-1292
  • article
    https://www.openssl.org/news/secadv/20220503.txt
  • report
    https://access.redhat.com/security/cve/CVE-2022-2068
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-2068
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-2068
  • article
    https://www.openssl.org/news/secadv/20220621.txt
  • report
    https://access.redhat.com/security/cve/CVE-2022-41717
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-41717
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-41717
  • article
    https://go.dev/cl/455635
  • article
    https://go.dev/cl/455717
  • article
    https://go.dev/issue/56350
  • article
    https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU/m/yZDrXjIiBQAJ
  • advisory
    https://pkg.go.dev/vuln/GO-2022-1144
  • report
    https://access.redhat.com/security/cve/CVE-2023-39325
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-39325
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-39325
  • report
    https://access.redhat.com/security/cve/CVE-2023-44487
  • article
    https://go.dev/issue/63417
  • advisory
    https://pkg.go.dev/vuln/GO-2023-2102
  • article
    https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-44487
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-44487
  • article
    https://github.com/dotnet/announcements/issues/277
  • article
    https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/
  • article
    https://www.cisa.gov/known-exploited-vulnerabilities-catalog