Skip to content
OpenAdvisories
Critical RHSA-2025:17614 3 CVEs

Red Hat Security Advisory: Satellite 6.15.5.5 Async Update

Published Oct 9, 2025 · Updated Jun 30, 2026

Ecosystem: Red Hat

Fixed packages 12

ReleasePackageFixed in
Red Hat · Satellite Capsule 6 satellite_capsule:6.15::el8 cjson 0:1.7.18-2.el8sat
Red Hat · Satellite Capsule 6 satellite_capsule:6.15::el8 cjson-debuginfo 0:1.7.18-2.el8sat
Red Hat · Satellite Capsule 6 satellite_capsule:6.15::el8 cjson-debugsource 0:1.7.18-2.el8sat
Red Hat · Satellite Capsule 6 satellite_capsule:6.15::el8 puppet-agent 0:7.34.0-4.el8sat
Red Hat · Satellite Capsule 6 satellite_capsule:6.15::el8 python-django 0:4.2.24-0.1.el8pc
Red Hat · Satellite Capsule 6 satellite_capsule:6.15::el8 python3.11-django 0:4.2.24-0.1.el8pc
Red Hat · Satellite 6 satellite:6.15::el8 cjson 0:1.7.18-2.el8sat
Red Hat · Satellite 6 satellite:6.15::el8 cjson-debuginfo 0:1.7.18-2.el8sat
Red Hat · Satellite 6 satellite:6.15::el8 cjson-debugsource 0:1.7.18-2.el8sat
Red Hat · Satellite 6 satellite:6.15::el8 puppet-agent 0:7.34.0-4.el8sat
Red Hat · Satellite 6 satellite:6.15::el8 python-django 0:4.2.24-0.1.el8pc
Red Hat · Satellite 6 satellite:6.15::el8 python3.11-django 0:4.2.24-0.1.el8pc

Vulnerabilities 3

  • Critical 9.8
    CVE-2025-57052 Public exploit

    cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.…

    cjson cjson cjson Debian Ubuntu Alpine
  • High 7.1
    CVE-2025-57833 Public exploit EPSS 28%

    Django is subject to SQL injection through its column aliases

    An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annot…

    djangoproject Django python-django django Debian Ubuntu Alpine PyPI
  • Medium 6.6
    CVE-2024-49761

    REXML ReDoS vulnerability

    REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;). This does not happen with Ruby 3.2 or later. Ruby 3.1 is the…

    ruby rexml kube-fluentd-operator ruby2.3 Debian Ubuntu Azure Linux Alpine Wolfi RubyGems

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2392894
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2392990
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2398216
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_17614.json
  • report
    https://access.redhat.com/security/cve/CVE-2024-49761
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2322153
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-49761
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-49761
  • article
    https://github.com/ruby/rexml/commit/ce59f2eb1aeb371fe1643414f06618dbe031979f
  • article
    https://github.com/ruby/rexml/security/advisories/GHSA-2rxp-v6pw-ch6m
  • article
    https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761
  • report
    https://access.redhat.com/security/cve/CVE-2025-57052
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-57052
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-57052
  • article
    https://x-0r.com/posts/cJSON-Array-Index-Parsing-Vulnerability
  • report
    https://access.redhat.com/security/cve/CVE-2025-57833
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-57833
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-57833
  • article
    https://docs.djangoproject.com/en/dev/releases/security/
  • article
    https://groups.google.com/g/django-announce
  • article
    https://www.djangoproject.com/weblog/2025/sep/03/security-releases/