Red Hat Security Advisory: Satellite 6.15.3 Security Update

Fixed packages 24

Vulnerabilities 5

• High 7.5
  CVE-2024-24680

  Django denial-of-service attack in the intcomma template filter

  An issue was discovered in Django 3.2 before 3.2.24, 4.2 before 4.2.10, and Django 5.0 before 5.0.2. The intcomma template filter was subject to a potential denial-of-service attack when used with very long strings.

  python-django django python-django py3-django Debian Ubuntu Wolfi PyPI
  Feb 6, 2024
• Medium 6.7
  CVE-2024-28219

  Pillow buffer overflow vulnerability

  In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy.

  kubeflow-pipelines-visualization-server pillow pillow pillow Debian Ubuntu Alpine Wolfi PyPI
  Apr 3, 2024
• Medium 6.1
  CVE-2024-27306

  aiohttp vulnerable to XSS on index pages for static file handling

  aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulnerability is fixed in 3.9.4. We have always recommended using a reverse proxy server (e.g. nginx) for …

  aio-libs aiohttp kserve-storage-controller py3-cassandra-medusa Debian Ubuntu Azure Linux Wolfi PyPI
  Apr 18, 2024
• Medium 5.4
  CVE-2024-34064 Public exploit

  Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter

  Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `>`, or `=`, as each would then be interpreted as starting a separat…

  pallets jinja nodejs kubeflow-pipelines-visualization-server Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  May 6, 2024
• Medium 5.3
  CVE-2024-27351

  Regular expression denial-of-service in Django

  In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words() method (with html=True) and the truncatewords_html template filter are subject to a potential regular expression denial-of-service attack via a craft…

  python-django django python-django py3-django Debian Ubuntu Alpine Wolfi PyPI
  Mar 15, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-us/red_hat_satellite/6.15/html/updating_red_hat_satellite/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2261856
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2266045
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2272563
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2275989
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2279476
• article
  https://issues.redhat.com/browse/SAT-25063
• article
  https://issues.redhat.com/browse/SAT-25522
• article
  https://issues.redhat.com/browse/SAT-26450
• article
  https://issues.redhat.com/browse/SAT-26452
• article
  https://issues.redhat.com/browse/SAT-26453
• article
  https://issues.redhat.com/browse/SAT-26454
• article
  https://issues.redhat.com/browse/SAT-26456
• article
  https://issues.redhat.com/browse/SAT-26458
• article
  https://issues.redhat.com/browse/SAT-26459
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_5662.json
• report
  https://access.redhat.com/security/cve/CVE-2024-24680
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-24680
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-24680
• advisory
  https://github.com/advisories/GHSA-xxj9-f6rv-m3x4
• article
  https://www.djangoproject.com/weblog/2024/feb/06/security-releases/
• report
  https://access.redhat.com/security/cve/CVE-2024-27306
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-27306
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-27306
• report
  https://access.redhat.com/security/cve/CVE-2024-27351
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-27351
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-27351
• article
  https://www.djangoproject.com/weblog/2024/mar/04/security-releases/
• report
  https://access.redhat.com/security/cve/CVE-2024-28219
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-28219
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-28219
• report
  https://access.redhat.com/security/cve/CVE-2024-34064
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-34064
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-34064
• article
  https://github.com/pallets/jinja/security/advisories/GHSA-h75v-3vvj-5mfj