Skip to content
OpenAdvisories
High RHSA-2025:19832 3 CVEs

Red Hat Security Advisory: Satellite 6.17.6 Async Update

Published Nov 6, 2025 · Updated Sep 1, 2026

Ecosystem: Red Hat

Fixed packages 22

ReleasePackageFixed in
Red Hat · Satellite Capsule 6 satellite_capsule:6.17::el9 foreman 0:3.14.0.10-1.el9sat
Red Hat · Satellite Capsule 6 satellite_capsule:6.17::el9 foreman-debug 0:3.14.0.10-1.el9sat
Red Hat · Satellite Capsule 6 satellite_capsule:6.17::el9 foreman-pcp 0:3.14.0.10-1.el9sat
Red Hat · Satellite Capsule 6 satellite_capsule:6.17::el9 rubygem-rack 0:2.2.20-1.el9sat
Red Hat · Satellite Utils 6 satellite_utils:6.17::el9 foreman 0:3.14.0.10-1.el9sat
Red Hat · Satellite Utils 6 satellite_utils:6.17::el9 foreman-cli 0:3.14.0.10-1.el9sat
Red Hat · Satellite 6 satellite:6.17::el9 foreman 0:3.14.0.10-1.el9sat
Red Hat · Satellite 6 satellite:6.17::el9 foreman-cli 0:3.14.0.10-1.el9sat
Red Hat · Satellite 6 satellite:6.17::el9 foreman-debug 0:3.14.0.10-1.el9sat
Red Hat · Satellite 6 satellite:6.17::el9 foreman-dynflow-sidekiq 0:3.14.0.10-1.el9sat
Red Hat · Satellite 6 satellite:6.17::el9 foreman-ec2 0:3.14.0.10-1.el9sat
Red Hat · Satellite 6 satellite:6.17::el9 foreman-journald 0:3.14.0.10-1.el9sat
Red Hat · Satellite 6 satellite:6.17::el9 foreman-libvirt 0:3.14.0.10-1.el9sat
Red Hat · Satellite 6 satellite:6.17::el9 foreman-openstack 0:3.14.0.10-1.el9sat
Red Hat · Satellite 6 satellite:6.17::el9 foreman-ovirt 0:3.14.0.10-1.el9sat
Red Hat · Satellite 6 satellite:6.17::el9 foreman-pcp 0:3.14.0.10-1.el9sat
Red Hat · Satellite 6 satellite:6.17::el9 foreman-postgresql 0:3.14.0.10-1.el9sat
Red Hat · Satellite 6 satellite:6.17::el9 foreman-redis 0:3.14.0.10-1.el9sat
Red Hat · Satellite 6 satellite:6.17::el9 foreman-service 0:3.14.0.10-1.el9sat
Red Hat · Satellite 6 satellite:6.17::el9 foreman-telemetry 0:3.14.0.10-1.el9sat
Red Hat · Satellite 6 satellite:6.17::el9 foreman-vmware 0:3.14.0.10-1.el9sat
Red Hat · Satellite 6 satellite:6.17::el9 rubygem-rack 0:2.2.20-1.el9sat

Vulnerabilities 3

  • High 8.0
    CVE-2025-10622

    Foreman: os command injection via ct_location and fcct_location parameters

    A flaw was found in Red Hat Satellite (Foreman component). This vulnerability allows an authenticated user with edit_settings permissions to achieve arbitrary command execution on the underlying operating system via insufficient server-side validation of comm…

    Red Hat The Foreman Project Red Hat Satellite 6 Red Hat Satellite 6.16 for RHEL 8
  • High 7.5
    CVE-2025-59830

    Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parameters

    Rack is a modular Ruby web server interface. Prior to version 2.2.18, Rack::QueryParser enforces its params_limit only for parameters separated by &, while still splitting on both & and ;. As a result, attackers could use ; separators to bypass the parameter …

    rack rack rack ruby-rack Debian Ubuntu Wolfi RubyGems
  • High 7.5
    CVE-2025-61919

    Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsing

    Rack is a modular Ruby web server interface. Prior to versions 2.2.20, 3.1.18, and 3.2.3, `Rack::Request#POST` reads the entire request body into memory for `Content-Type: application/x-www-form-urlencoded`, calling `rack.input.read(nil)` without enforcing a …

    rack rack kube-fluentd-operator rack Debian Ubuntu Wolfi RubyGems

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • article
    https://docs.redhat.com/en/documentation/red_hat_satellite/6.17/html/updating_red_hat_satellite/index
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2396020
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2398167
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2403180
  • article
    https://issues.redhat.com/browse/SAT-39213
  • article
    https://issues.redhat.com/browse/SAT-39215
  • article
    https://issues.redhat.com/browse/SAT-39216
  • article
    https://issues.redhat.com/browse/SAT-39217
  • article
    https://issues.redhat.com/browse/SAT-39218
  • article
    https://issues.redhat.com/browse/SAT-39219
  • article
    https://issues.redhat.com/browse/SAT-39232
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_19832.json
  • report
    https://access.redhat.com/security/cve/CVE-2025-10622
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-10622
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-10622
  • article
    https://theforeman.org/security.html#2025-10622
  • report
    https://access.redhat.com/security/cve/CVE-2025-59830
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-59830
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-59830
  • article
    https://github.com/rack/rack/commit/54e4ffdd5affebcb0c015cc6ae74635c0831ed71
  • article
    https://github.com/rack/rack/security/advisories/GHSA-625h-95r8-8xpm
  • report
    https://access.redhat.com/security/cve/CVE-2025-61919
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-61919
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-61919
  • article
    https://github.com/rack/rack/commit/4e2c903991a790ee211a3021808ff4fd6fe82881
  • article
    https://github.com/rack/rack/commit/cbd541e8a3d0c5830a3c9a30d3718ce2e124f9db
  • article
    https://github.com/rack/rack/commit/e179614c4a653283286f5f046428cbb85f21146f
  • article
    https://github.com/rack/rack/security/advisories/GHSA-6xw4-3v39-52mm