Red Hat Security Advisory: Satellite 6.17.5 Async Update

Fixed packages 12

Vulnerabilities 3

• Critical 9.8
  CVE-2025-57052 Public exploit

  cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.…

  cjson cjson cjson Debian Ubuntu Alpine
  Sep 3, 2025
• High 7.5
  CVE-2025-10990

  Rexml: rexml: denial of service via inefficient regex parsing

  A flaw was found in REXML. A remote attacker could exploit inefficient regular expression (regex) parsing when processing hex numeric character references (&#x...;) in XML documents. This could lead to a Regular Expression Denial of Service (ReDoS), impacting…

  Red Hat Red Hat Satellite 6.16 for RHEL 8 Red Hat Satellite 6.17 for RHEL 9 Red Hat Satellite 6.16 for RHEL 9 Ubuntu
  Feb 27, 2026
• High 7.1
  CVE-2025-57833 Public exploit EPSS 28%

  Django is subject to SQL injection through its column aliases

  An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annot…

  djangoproject Django python-django django Debian Ubuntu Alpine PyPI
  Sep 3, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://access.redhat.com/documentation/en-us/red_hat_satellite/6.17/html/updating_red_hat_satellite/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2392894
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2392990
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2398216
• article
  https://issues.redhat.com/browse/SAT-38394
• article
  https://issues.redhat.com/browse/SAT-38396
• article
  https://issues.redhat.com/browse/SAT-38397
• article
  https://issues.redhat.com/browse/SAT-38398
• article
  https://issues.redhat.com/browse/SAT-38496
• article
  https://issues.redhat.com/browse/SAT-38730
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_17606.json
• report
  https://access.redhat.com/security/cve/CVE-2025-10990
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-10990
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-10990
• article
  https://github.com/ruby/rexml/commit/ce59f2eb1aeb371fe1643414f06618dbe031979f
• article
  https://github.com/ruby/rexml/security/advisories/GHSA-2rxp-v6pw-ch6m
• article
  https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761/
• report
  https://access.redhat.com/security/cve/CVE-2025-57052
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-57052
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-57052
• article
  https://x-0r.com/posts/cJSON-Array-Index-Parsing-Vulnerability
• report
  https://access.redhat.com/security/cve/CVE-2025-57833
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-57833
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-57833
• article
  https://docs.djangoproject.com/en/dev/releases/security/
• article
  https://groups.google.com/g/django-announce
• article
  https://www.djangoproject.com/weblog/2025/sep/03/security-releases/