Red Hat Security Advisory: Satellite 6.14.1 Async Security Update

Fixed packages 90

Vulnerabilities 5

• Medium 6.7
  CVE-2023-4886

  Foreman: world readable file containing secrets

  A sensitive information exposure vulnerability was found in foreman. Contents of tomcat's server.xml file, which contain passwords to candlepin's keystore and truststore, were found to be world readable.

  Red Hat Red Hat Satellite 6.14 for RHEL 8 Red Hat Satellite 6.13 for RHEL 8
  Oct 3, 2023
• Medium 5.9
  CVE-2023-43804 Public exploit

  `Cookie` HTTP header isn't stripped on cross-origin redirects

  urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `C…

  urllib3 urllib3 python3 dask-gateway Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  Oct 4, 2023
• Medium 4.2
  CVE-2023-45803

  Request body not stripped after redirect in urllib3

  urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method changed from one that could accept a request body…

  urllib3 urllib3 katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  Oct 17, 2023
• Medium 4.0
  CVE-2023-28362

  Actionpack has possible cross-site scripting vulnerability via User Supplied Values to redirect_to

  The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for downstream services which enforce RFC compliance on HTTP response headers to remove the assigned Locati…

  rails Action Pack rails rails Debian Ubuntu RubyGems
  Jan 9, 2025
• Medium 4.0
  CVE-2023-41040

  GitPython blind local file inclusion

  GitPython is a python library used to interact with Git repositories. In order to resolve some git references, GitPython reads files from the `.git` directory, in some places the name of the file being read is provided by the user, GitPython doesn't check if …

  gitpython-developers GitPython gitpython python-git Debian Ubuntu Alpine PyPI
  Aug 30, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-us/red_hat_satellite/6.14/html/upgrading_red_hat_satellite_to_6.14/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2217785
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2230135
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2246840
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2247040
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2250342
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2250343
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2250344
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2250345
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2250349
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2250350
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2250351
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2250352
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2251799
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2254080
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2254085
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7851.json
• report
  https://access.redhat.com/security/cve/CVE-2023-4886
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-4886
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-4886
• report
  https://access.redhat.com/security/cve/CVE-2023-28362
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-28362
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-28362
• article
  https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2023-28362.yml
• report
  https://access.redhat.com/security/cve/CVE-2023-41040
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-41040
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-41040
• article
  https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-cwvm-v4w8-q58c
• report
  https://access.redhat.com/security/cve/CVE-2023-43804
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2242493
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-43804
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-43804
• report
  https://access.redhat.com/security/cve/CVE-2023-45803
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-45803
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-45803
• article
  https://github.com/urllib3/urllib3/commit/4e98d57809dacab1cbe625fddeec1a290c478ea9
• article
  https://github.com/urllib3/urllib3/security/advisories/GHSA-g4mx-q9vg-27p4
• article
  https://www.rfc-editor.org/rfc/rfc9110.html#name-get