Red Hat Security Advisory: Red Hat Satellite 6 security and bug fix update

Fixed packages 23

Vulnerabilities 5

• High 7.5
  CVE-2023-28366

  The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a cl…

  mosquitto mosquitto mosquitto Debian Ubuntu Alpine
  Sep 1, 2023
• Medium 6.7
  CVE-2023-4886

  Foreman: world readable file containing secrets

  A sensitive information exposure vulnerability was found in foreman. Contents of tomcat's server.xml file, which contain passwords to candlepin's keystore and truststore, were found to be world readable.

  Red Hat Red Hat Satellite 6.14 for RHEL 8 Red Hat Satellite 6.13 for RHEL 8
  Oct 3, 2023
• Medium 5.8
  CVE-2023-0809

  In Mosquitto before 2.0.16, excessive memory is allocated based on malicious initial packets that are not CONNECT packe…

  Eclipse Foundation Mosquitto mosquitto mosquitto Debian Ubuntu Alpine
  Oct 2, 2023
• Medium 5.8
  CVE-2023-3592

  In Mosquitto before 2.0.16, a memory leak occurs when clients send v5 CONNECT packets with a will message that contains…

  Eclipse Foundation Mosquitto mosquitto mosquitto Debian Ubuntu Alpine
  Oct 2, 2023
• Medium 4.5
  CVE-2022-4130

  A blind site-to-site request forgery vulnerability was found in Satellite server. It is possible to trigger an external…

  Dec 16, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-us/red_hat_satellite/6.13/html/upgrading_and_updating_red_hat_satellite/index
• article
  https://access.redhat.com/security/vulnerabilities/RHSB-2023-003
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2145254
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2230135
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2236882
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2257299
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2257300
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2257302
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2257314
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2257316
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2260526
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2264354
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2264918
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2265149
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1061.json
• report
  https://access.redhat.com/security/cve/CVE-2022-4130
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-4130
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-4130
• report
  https://access.redhat.com/security/cve/CVE-2023-0809
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-0809
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-0809
• article
  https://github.com/eclipse/mosquitto/commit/6113eac95a9df634fbc858be542c4a0456bfe7b9
• report
  https://access.redhat.com/security/cve/CVE-2023-3592
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-3592
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-3592
• report
  https://access.redhat.com/security/cve/CVE-2023-4886
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-4886
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-4886
• report
  https://access.redhat.com/security/cve/CVE-2023-28366
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-28366
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-28366