Red Hat Security Advisory: Satellite 6.14.2 Async Security Update

Fixed packages 17

Vulnerabilities 10

• High 8.8
  CVE-2023-38545 Public exploit EPSS 78%

  This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the h…

  curl curl curl curl Debian Ubuntu Azure Linux Alpine Wolfi
  Oct 18, 2023
• High 7.5
  CVE-2023-26141

  sidekiq Denial of Service vulnerability

  Versions of the package sidekiq before 7.1.3 are vulnerable to Denial of Service (DoS) due to insufficient checks in the dashboard-charts.js file. An attacker can exploit this vulnerability by manipulating the localStorage value which will cause excessive pol…

  sidekiq RubyGems
  Sep 14, 2023
• High 7.5
  CVE-2023-28366

  The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a cl…

  mosquitto mosquitto mosquitto Debian Ubuntu Alpine
  Sep 1, 2023
• High 7.5
  CVE-2023-4785

  Denial of Service in gRPC Core

  Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Pyt…

  Google gRPC kube-fluentd-operator kube-fluentd-operator-default-config Debian Ubuntu Azure Linux Wolfi PyPI RubyGems
  Sep 13, 2023
• High 7.3
  CVE-2023-40175

  Inconsistent Interpretation of HTTP Requests in puma

  Puma is a Ruby/Rack web server built for parallelism. Prior to versions 6.3.1 and 5.6.7, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers in a way that allowed HTTP request smuggling. Sever…

  puma puma puma puma Debian Ubuntu RubyGems
  Aug 18, 2023
• Medium 5.8
  CVE-2023-0809

  In Mosquitto before 2.0.16, excessive memory is allocated based on malicious initial packets that are not CONNECT packe…

  Eclipse Foundation Mosquitto mosquitto mosquitto Debian Ubuntu Alpine
  Oct 2, 2023
• Medium 5.8
  CVE-2023-3592

  In Mosquitto before 2.0.16, a memory leak occurs when clients send v5 CONNECT packets with a will message that contains…

  Eclipse Foundation Mosquitto mosquitto mosquitto Debian Ubuntu Alpine
  Oct 2, 2023
• Medium 5.3
  CVE-2023-40167 Public exploit

  Jetty accepts "+" prefixed value in Content-Length

  Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the `+` character proceeding the content-length value in a HTTP/1 header field. This is more permissive than allowed by the RFC and othe…

  Eclipse Foundation jetty.project druid cassandra-reaper Debian Ubuntu Wolfi Maven
  Sep 15, 2023
• Low 3.5
  CVE-2023-36479

  Jetty vulnerable to errant command quoting in CGI Servlet

  Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to a org.eclipse.jetty.servlets.CGI Servlet for…

  Eclipse Foundation jetty.project cassandra-reaper jetty9 Debian Ubuntu Wolfi Maven
  Sep 15, 2023
• Low 2.4
  CVE-2023-26049 Public exploit

  Cookie parsing of quoted values can exfiltrate values from other cookies in Eclipse Jetty

  Jetty is a java based web server and servlet engine. Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies, or otherwise perform unintended behavior by tampering with the cookie parsing mechanism. If Jetty sees a co…

  Eclipse Foundation jetty.project cassandra-reaper jetty9 Debian Ubuntu Wolfi Maven
  Apr 18, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://access.redhat.com/documentation/en-us/red_hat_satellite/6.14/html/upgrading_and_updating_red_hat_satellite/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2232729
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2236341
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2236882
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2239010
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2239017
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2239630
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2239634
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2241933
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2250347
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2254974
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2255260
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2257321
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2257324
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2257326
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2257327
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2257329
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2257330
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2257331
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2257332
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2257415
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2260525
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2262131
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0797.json
• report
  https://access.redhat.com/security/cve/CVE-2023-0809
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-0809
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-0809
• article
  https://github.com/eclipse/mosquitto/commit/6113eac95a9df634fbc858be542c4a0456bfe7b9
• report
  https://access.redhat.com/security/cve/CVE-2023-3592
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-3592
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-3592
• report
  https://access.redhat.com/security/cve/CVE-2023-4785
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-4785
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-4785
• advisory
  https://github.com/advisories/GHSA-p25m-jpj4-qcrr
• article
  https://github.com/grpc/grpc/pull/33656
• article
  https://github.com/grpc/grpc/pull/33667
• article
  https://github.com/grpc/grpc/pull/33669