Red Hat Security Advisory: Satellite 6.16.3 Async Update

Fixed packages 144

Vulnerabilities 3

• Medium 5.8
  CVE-2024-56374

  Django has a potential denial-of-service vulnerability in IPv6 validation

  An issue was discovered in Django 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18. Lack of upper-bound limit enforcement in strings passed when performing IPv6 validation could lead to a potential denial-of-service attack. The undocumented and priv…

  djangoproject Django python-django django Debian Ubuntu Alpine Wolfi PyPI
  Jan 14, 2025
• Medium 5.6
  CVE-2024-35195

  Requests `Session` object does not verify requests after making first request with verify=False

  Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification r…

  psf requests katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  May 20, 2024
• Medium 5.4
  CVE-2024-56326

  Jinja has a sandbox breakout through indirect reference to format method

  Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability…

  pallets jinja kserve-storage-controller kubeflow-pipelines-visualization-server Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  Dec 23, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-us/red_hat_satellite/6.16/html/updating_red_hat_satellite/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2333856
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2337996
• article
  https://issues.redhat.com/browse/SAT-30027
• article
  https://issues.redhat.com/browse/SAT-30099
• article
  https://issues.redhat.com/browse/SAT-30256
• article
  https://issues.redhat.com/browse/SAT-30283
• article
  https://issues.redhat.com/browse/SAT-30293
• article
  https://issues.redhat.com/browse/SAT-30294
• article
  https://issues.redhat.com/browse/SAT-30918
• article
  https://issues.redhat.com/browse/SAT-30934
• article
  https://issues.redhat.com/browse/SAT-30936
• article
  https://issues.redhat.com/browse/SAT-30937
• article
  https://issues.redhat.com/browse/SAT-30938
• article
  https://issues.redhat.com/browse/SAT-30939
• article
  https://issues.redhat.com/browse/SAT-30940
• article
  https://issues.redhat.com/browse/SAT-30941
• article
  https://issues.redhat.com/browse/SAT-30942
• article
  https://issues.redhat.com/browse/SAT-30954
• article
  https://issues.redhat.com/browse/SAT-30955
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_2399.json
• report
  https://access.redhat.com/security/cve/CVE-2024-35195
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2282114
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-35195
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-35195
• article
  https://github.com/psf/requests/security/advisories/GHSA-9wx4-h78v-vm56
• report
  https://access.redhat.com/security/cve/CVE-2024-56326
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-56326
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-56326
• article
  https://github.com/pallets/jinja/commit/48b0687e05a5466a91cd5812d604fa37ad0943b4
• article
  https://github.com/pallets/jinja/releases/tag/3.1.5
• article
  https://github.com/pallets/jinja/security/advisories/GHSA-q2x7-8rv6-6q7h
• report
  https://access.redhat.com/security/cve/CVE-2024-56374
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-56374
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-56374
• article
  http://www.openwall.com/lists/oss-security/2025/01/14/2
• article
  https://docs.djangoproject.com/en/dev/releases/security/
• article
  https://groups.google.com/g/django-announce