Red Hat Security Advisory: Satellite 6.16.0 release

Fixed packages 400

Vulnerabilities 14

• Critical 9.8
  CVE-2024-42005

  Django SQL injection vulnerability

  An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values() and values_list() methods on models with a JSONField are subject to SQL injection in column aliases via a crafted JSON object key as a passed *arg.

  python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  Aug 7, 2024
• Critical 9.8
  CVE-2024-7012

  Puppet-foreman: an authentication bypass vulnerability exists in foreman

  An authentication bypass vulnerability has been identified in Foreman when deployed with External Authentication, due to the puppet-foreman configuration. This issue arises from Apache's mod_proxy not properly unsetting headers because of restrictions on unde…

  Red Hat Red Hat Satellite 6.16 for RHEL 8 Red Hat Satellite 6.16 for RHEL 9 Red Hat Satellite 6.15 for RHEL 8
  Sep 4, 2024
• Critical 9.8
  CVE-2024-7923

  Puppet-pulpcore: an authentication bypass vulnerability exists in pulpcore

  An authentication bypass vulnerability has been identified in Pulpcore when deployed with Gunicorn versions prior to 22.0, due to the puppet-pulpcore configuration. This issue arises from Apache's mod_proxy not properly unsetting headers because of restrictio…

  Red Hat Red Hat Satellite 6.16 for RHEL 8 Red Hat Satellite 6.16 for RHEL 9 Red Hat Update Infrastructure 4 for Cloud Providers
  Sep 4, 2024
• High 7.5
  CVE-2024-38875

  Django vulnerable to Denial of Service

  An issue was discovered in Django 4.2 before 4.2.14 and 5.0 before 5.0.7. urlize and urlizetrunc were subject to a potential denial of service attack via certain inputs with a very large number of brackets.

  python-django django python-django py3-django Debian Ubuntu Alpine Wolfi PyPI
  Jul 10, 2024
• High 7.5
  CVE-2024-39614 Public exploit EPSS 29%

  Django vulnerable to Denial of Service

  An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. get_supported_language_variant() was subject to a potential denial-of-service attack when used with very long strings containing specific characters.

  python-django django python-django py3-django Debian Ubuntu Alpine Wolfi PyPI
  Jul 10, 2024
• High 7.2
  CVE-2024-8376

  Memory leak

  In Eclipse Mosquitto up to version 2.0.18a, an attacker can achieve memory leaking, segmentation fault or heap-use-after-free by sending specific sequences of "CONNECT", "DISCONNECT", "SUBSCRIBE", "UNSUBSCRIBE" and "PUBLISH" packets.

  Eclipse Foundation Mosquitto mosquitto mosquitto Debian Ubuntu
  Oct 11, 2024
• Medium 6.5
  CVE-2024-28863

  node-tar vulnerable to denial of service while parsing a tar file due to lack of folders count validation

  node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even…

  isaacs node-tar nodejs lerna Debian Ubuntu Azure Linux Wolfi npm
  Mar 21, 2024
• Medium 6.3
  CVE-2024-7246

  HPACK table poisoning in gRPC C++, Python & Ruby

  It's possible for a gRPC client communicating with a HTTP/2 proxy to poison the HPACK table between the proxy and the backend such that other clients see failed requests. It's also possible to use this vulnerability to leak other clients HTTP header keys, but…

  Google gRPC grpc grpc Debian Ubuntu Azure Linux
  Aug 6, 2024
• Medium 6.3
  CVE-2024-8553

  Foreman: read-only access to entire db from templates

  A vulnerability was found in Foreman's loader macros introduced with report templates. These macros may allow an authenticated user with permissions to view and create templates to read any field from Foreman's database. By using specific strings in the loade…

  Red Hat Red Hat Satellite 6.16 for RHEL 8 Red Hat Satellite 6.16 for RHEL 9 Red Hat Satellite 6.15 for RHEL 8
  Oct 31, 2024
• Medium 6.2
  CVE-2024-5569

  Denial of Service via crafted zip file in jaraco/zipp

  A Denial of Service (DoS) vulnerability exists in the jaraco/zipp library, affecting all versions prior to 3.19.1. The vulnerability is triggered when processing a specially crafted zip file that leads to an infinite loop. This issue also impacts the zipfile …

  jaraco jaraco/zipp kubeflow-pipelines-apiserver tensorflow Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  Jul 9, 2024
• Medium 5.3
  CVE-2024-39329

  Django vulnerable to user enumeration attack

  An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. The django.contrib.auth.backends.ModelBackend.authenticate() method allows remote attackers to enumerate users via a timing attack involving login requests for users with an unusable pa…

  python-django django python-django py3-django Debian Ubuntu Alpine Wolfi PyPI
  Jul 10, 2024
• Medium 5.3
  CVE-2024-4067

  Regular Expression Denial of Service in micromatch

  The NPM package `micromatch` prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in `micromatch.braces()` in `index.js` because the pattern `.*` will greedily match anything. By passing a malicious payload, t…

  micromatch micromatch katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Wolfi npm
  May 13, 2024
• Medium 4.4
  CVE-2024-37891

  Proxy-Authorization request header isn't stripped during cross-origin redirects in urllib3

  urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with `ProxyManager`, the `Proxy-Authorization` header is only sent to the configured proxy, as expected. However, when sending HTTP requests *without* using urllib3'…

  urllib3 urllib3 katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Wolfi PyPI
  Jun 17, 2024
• Medium 4.3
  CVE-2024-39330

  Django Path Traversal vulnerability

  An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. Derived classes of the django.core.files.storage.Storage base class, when they override generate_filename() without replicating the file-path validations from the parent class, potentia…

  python-django django python-django py3-django Debian Ubuntu Alpine Wolfi PyPI
  Jul 10, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#critical
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2280601
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2292788
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2293200
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2295935
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2295936
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2295937
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2295938
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2296413
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2299429
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2302436
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2305718
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2312524
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2318080
• article
  https://issues.redhat.com/browse/SAT-12847
• article
  https://issues.redhat.com/browse/SAT-15089
• article
  https://issues.redhat.com/browse/SAT-15466
• article
  https://issues.redhat.com/browse/SAT-15467
• article
  https://issues.redhat.com/browse/SAT-15549
• article
  https://issues.redhat.com/browse/SAT-16224
• article
  https://issues.redhat.com/browse/SAT-16247
• article
  https://issues.redhat.com/browse/SAT-16381
• article
  https://issues.redhat.com/browse/SAT-16537
• article
  https://issues.redhat.com/browse/SAT-16593
• article
  https://issues.redhat.com/browse/SAT-17442
• article
  https://issues.redhat.com/browse/SAT-17443
• article
  https://issues.redhat.com/browse/SAT-17785
• article
  https://issues.redhat.com/browse/SAT-18093
• article
  https://issues.redhat.com/browse/SAT-18270
• article
  https://issues.redhat.com/browse/SAT-18327
• article
  https://issues.redhat.com/browse/SAT-18410
• article
  https://issues.redhat.com/browse/SAT-18461
• article
  https://issues.redhat.com/browse/SAT-18568
• article
  https://issues.redhat.com/browse/SAT-18610
• article
  https://issues.redhat.com/browse/SAT-18705
• article
  https://issues.redhat.com/browse/SAT-18721
• article
  https://issues.redhat.com/browse/SAT-18859
• article
  https://issues.redhat.com/browse/SAT-18993
• article
  https://issues.redhat.com/browse/SAT-19018