Red Hat Security Advisory: Satellite 6.17.3 Async Update

Fixed packages 4

Vulnerabilities 1

• Medium 6.6
  CVE-2024-49761

  REXML ReDoS vulnerability

  REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;). This does not happen with Ruby 3.2 or later. Ruby 3.1 is the…

  ruby rexml kube-fluentd-operator ruby2.3 Debian Ubuntu Azure Linux Alpine Wolfi RubyGems
  Oct 28, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-us/red_hat_satellite/6.17/html/updating_red_hat_satellite/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2322153
• article
  https://issues.redhat.com/browse/SAT-35573
• article
  https://issues.redhat.com/browse/SAT-35575
• article
  https://issues.redhat.com/browse/SAT-35576
• article
  https://issues.redhat.com/browse/SAT-35577
• article
  https://issues.redhat.com/browse/SAT-35579
• article
  https://issues.redhat.com/browse/SAT-35580
• article
  https://issues.redhat.com/browse/SAT-35581
• article
  https://issues.redhat.com/browse/SAT-35582
• article
  https://issues.redhat.com/browse/SAT-35583
• article
  https://issues.redhat.com/browse/SAT-35584
• article
  https://issues.redhat.com/browse/SAT-35586
• article
  https://issues.redhat.com/browse/SAT-35587
• article
  https://issues.redhat.com/browse/SAT-35718
• article
  https://issues.redhat.com/browse/SAT-36341
• article
  https://issues.redhat.com/browse/SAT-36426
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_13269.json
• report
  https://access.redhat.com/security/cve/CVE-2024-49761
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-49761
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-49761
• article
  https://github.com/ruby/rexml/commit/ce59f2eb1aeb371fe1643414f06618dbe031979f
• article
  https://github.com/ruby/rexml/security/advisories/GHSA-2rxp-v6pw-ch6m
• article
  https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761