Skip to content
OpenAdvisories
High RHSA-2025:19856 3 CVEs

Red Hat Security Advisory: Satellite 6.15.5.6 Async Update

Published Nov 6, 2025 · Updated Sep 1, 2026

Ecosystem: Red Hat

Fixed packages 22

ReleasePackageFixed in
Red Hat · Satellite Capsule 6 satellite_capsule:6.15::el8 foreman 0:3.9.1.13-1.el8sat
Red Hat · Satellite Capsule 6 satellite_capsule:6.15::el8 foreman-debug 0:3.9.1.13-1.el8sat
Red Hat · Satellite Capsule 6 satellite_capsule:6.15::el8 foreman-pcp 0:3.9.1.13-1.el8sat
Red Hat · Satellite Capsule 6 satellite_capsule:6.15::el8 rubygem-rack 0:2.2.20-1.el8sat
Red Hat · Satellite Utils 6 satellite_utils:6.15::el8 foreman 0:3.9.1.13-1.el8sat
Red Hat · Satellite Utils 6 satellite_utils:6.15::el8 foreman-cli 0:3.9.1.13-1.el8sat
Red Hat · Satellite 6 satellite:6.15::el8 foreman 0:3.9.1.13-1.el8sat
Red Hat · Satellite 6 satellite:6.15::el8 foreman-cli 0:3.9.1.13-1.el8sat
Red Hat · Satellite 6 satellite:6.15::el8 foreman-debug 0:3.9.1.13-1.el8sat
Red Hat · Satellite 6 satellite:6.15::el8 foreman-dynflow-sidekiq 0:3.9.1.13-1.el8sat
Red Hat · Satellite 6 satellite:6.15::el8 foreman-ec2 0:3.9.1.13-1.el8sat
Red Hat · Satellite 6 satellite:6.15::el8 foreman-journald 0:3.9.1.13-1.el8sat
Red Hat · Satellite 6 satellite:6.15::el8 foreman-libvirt 0:3.9.1.13-1.el8sat
Red Hat · Satellite 6 satellite:6.15::el8 foreman-openstack 0:3.9.1.13-1.el8sat
Red Hat · Satellite 6 satellite:6.15::el8 foreman-ovirt 0:3.9.1.13-1.el8sat
Red Hat · Satellite 6 satellite:6.15::el8 foreman-pcp 0:3.9.1.13-1.el8sat
Red Hat · Satellite 6 satellite:6.15::el8 foreman-postgresql 0:3.9.1.13-1.el8sat
Red Hat · Satellite 6 satellite:6.15::el8 foreman-redis 0:3.9.1.13-1.el8sat
Red Hat · Satellite 6 satellite:6.15::el8 foreman-service 0:3.9.1.13-1.el8sat
Red Hat · Satellite 6 satellite:6.15::el8 foreman-telemetry 0:3.9.1.13-1.el8sat
Red Hat · Satellite 6 satellite:6.15::el8 foreman-vmware 0:3.9.1.13-1.el8sat
Red Hat · Satellite 6 satellite:6.15::el8 rubygem-rack 0:2.2.20-1.el8sat

Vulnerabilities 3

  • High 8.0
    CVE-2025-10622

    Foreman: os command injection via ct_location and fcct_location parameters

    A flaw was found in Red Hat Satellite (Foreman component). This vulnerability allows an authenticated user with edit_settings permissions to achieve arbitrary command execution on the underlying operating system via insufficient server-side validation of comm…

    Red Hat The Foreman Project Red Hat Satellite 6 Red Hat Satellite 6.16 for RHEL 8
  • High 7.5
    CVE-2025-59830

    Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parameters

    Rack is a modular Ruby web server interface. Prior to version 2.2.18, Rack::QueryParser enforces its params_limit only for parameters separated by &, while still splitting on both & and ;. As a result, attackers could use ; separators to bypass the parameter …

    rack rack rack ruby-rack Debian Ubuntu Wolfi RubyGems
  • High 7.5
    CVE-2025-61919

    Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsing

    Rack is a modular Ruby web server interface. Prior to versions 2.2.20, 3.1.18, and 3.2.3, `Rack::Request#POST` reads the entire request body into memory for `Content-Type: application/x-www-form-urlencoded`, calling `rack.input.read(nil)` without enforcing a …

    rack rack kube-fluentd-operator rack Debian Ubuntu Wolfi RubyGems

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2396020
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2398167
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2403180
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_19856.json
  • report
    https://access.redhat.com/security/cve/CVE-2025-10622
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-10622
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-10622
  • article
    https://theforeman.org/security.html#2025-10622
  • report
    https://access.redhat.com/security/cve/CVE-2025-59830
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-59830
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-59830
  • article
    https://github.com/rack/rack/commit/54e4ffdd5affebcb0c015cc6ae74635c0831ed71
  • article
    https://github.com/rack/rack/security/advisories/GHSA-625h-95r8-8xpm
  • report
    https://access.redhat.com/security/cve/CVE-2025-61919
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-61919
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-61919
  • article
    https://github.com/rack/rack/commit/4e2c903991a790ee211a3021808ff4fd6fe82881
  • article
    https://github.com/rack/rack/commit/cbd541e8a3d0c5830a3c9a30d3718ce2e124f9db
  • article
    https://github.com/rack/rack/commit/e179614c4a653283286f5f046428cbb85f21146f
  • article
    https://github.com/rack/rack/security/advisories/GHSA-6xw4-3v39-52mm