Red Hat Security Advisory: Satellite 6.14.3 Async Security Update

Fixed packages 20

Vulnerabilities 7

• High 7.2
  CVE-2023-49081

  aiohttp's ClientSession is vulnerable to CRLF injection via version

  aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or create a new HTTP request if the attacker controls the HTTP versio…

  aio-libs aiohttp py3-cassandra-medusa python-aiohttp Debian Ubuntu Wolfi PyPI
  Nov 30, 2023
• Medium 6.5
  CVE-2024-23829

  aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators

  aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Security-sensitive parts of the Python HTTP parser retained minor differences in allowable character sets, that must trigger error handling to robustly match frame boundaries of p…

  aio-libs aiohttp py3-cassandra-medusa python-aiohttp Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  Jan 29, 2024
• Medium 6.3
  CVE-2023-5189

  Hub: insecure galaxy-importer tarfile extraction

  A path traversal vulnerability exists in Ansible when extracting tarballs. An attacker could craft a malicious tarball so that when using the galaxy importer of Ansible Automation Hub, a symlink could be dropped on the disk, resulting in files being overwritt…

  Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 8 Red Hat Ansible Automation Platform 2.4 for RHEL 9 Red Hat Satellite 6.15 for RHEL 8 Ubuntu PyPI
  Nov 14, 2023
• Medium 5.9
  CVE-2023-43665

  Django Denial-of-service in django.utils.text.Truncator

  In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service) attack via certain inputs with very long, potential…

  python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  Nov 3, 2023
• Medium 5.9
  CVE-2024-23334 Public exploit Scanner template EPSS 77%

  aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal

  aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'follow_symlinks' can be used…

  aio-libs aiohttp py3-cassandra-medusa python-aiohttp Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  Jan 29, 2024
• Medium 5.4
  CVE-2024-22195

  Jinja vulnerable to Cross-Site Scripting (XSS)

  Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS). …

  pallets jinja nodejs kubeflow-pipelines-visualization-server Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  Jan 11, 2024
• Medium 5.3
  CVE-2023-47627

  Request smuggling in aiohttp

  aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTP_NO_EXTENSIONS is enabled (or not…

  aio-libs aiohttp py3-cassandra-medusa python-aiohttp Debian Ubuntu Azure Linux Wolfi PyPI
  Nov 14, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-us/red_hat_satellite/6.14/html/upgrading_and_updating_red_hat_satellite/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2234387
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2241046
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2249825
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2252235
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2257854
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2261887
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2261909
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2266107
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2266110
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2266113
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2266139
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2266140
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2266141
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2266142
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2266144
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2266145
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2266146
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2266147
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2266148
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2266149
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2266413
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1536.json
• report
  https://access.redhat.com/security/cve/CVE-2023-5189
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-5189
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-5189
• report
  https://access.redhat.com/security/cve/CVE-2023-43665
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-43665
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-43665
• article
  https://www.djangoproject.com/weblog/2023/oct/04/security-releases/
• report
  https://access.redhat.com/security/cve/CVE-2023-47627
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-47627
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-47627
• article
  https://github.com/aio-libs/aiohttp/security/advisories/GHSA-gfw2-4jvh-wgfg
• report
  https://access.redhat.com/security/cve/CVE-2023-49081
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-49081
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-49081
• article
  https://github.com/aio-libs/aiohttp/security/advisories/GHSA-q3qx-c6g2-7pw2