Skip to content
OpenAdvisories
Critical RHSA-2025:3490 2 CVEs

Red Hat Security Advisory: Satellite 6.16.4 Async Update

Published Apr 2, 2025 · Updated Jul 12, 2026

Ecosystem: Red Hat

Fixed packages 6

ReleasePackageFixed in
Red Hat · Satellite Capsule 6 satellite_capsule:6.16::el8 rubygem-rack 0:2.2.13-1.el8sat
Red Hat · Satellite Capsule 6 satellite_capsule:6.16::el9 rubygem-rack 0:2.2.13-1.el9sat
Red Hat · Satellite 6 satellite:6.16::el8 rubygem-graphql 0:1.13.24-1.el8sat
Red Hat · Satellite 6 satellite:6.16::el8 rubygem-rack 0:2.2.13-1.el8sat
Red Hat · Satellite 6 satellite:6.16::el9 rubygem-graphql 0:1.13.24-1.el9sat
Red Hat · Satellite 6 satellite:6.16::el9 rubygem-rack 0:2.2.13-1.el9sat

Vulnerabilities 2

  • Critical 9.1
    CVE-2025-27407 Public exploit

    Remote code execution when loading a crafted GraphQL schema

    graphql-ruby is a Ruby implementation of GraphQL. Starting in version 1.11.5 and prior to versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21, loading a malicious schema definition in `GraphQL::Schema.from_introspection` (or `GraphQL::Schema…

    rmosolgo graphql-ruby graphql ruby-graphql Debian Ubuntu RubyGems
  • High 7.5
    CVE-2025-27610

    Local File Inclusion in Rack::Static

    Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.13, 3.0.14, and 3.1.12, `Rack::Static` can serve files under the specified `root:` even if `urls:` are provided, which may expose other files under the specified `root:`…

    rack rack kube-fluentd-operator rack Debian Ubuntu Wolfi RubyGems

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • article
    https://access.redhat.com/documentation/en-us/red_hat_satellite/6.16/html/updating_red_hat_satellite/index
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2351231
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2351767
  • article
    https://issues.redhat.com/browse/SAT-30808
  • article
    https://issues.redhat.com/browse/SAT-31568
  • article
    https://issues.redhat.com/browse/SAT-31569
  • article
    https://issues.redhat.com/browse/SAT-31570
  • article
    https://issues.redhat.com/browse/SAT-31571
  • article
    https://issues.redhat.com/browse/SAT-31572
  • article
    https://issues.redhat.com/browse/SAT-31576
  • article
    https://issues.redhat.com/browse/SAT-31577
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3490.json
  • report
    https://access.redhat.com/security/cve/CVE-2025-27407
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-27407
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-27407
  • article
    https://github.com/github-community-projects/graphql-client
  • article
    https://github.com/rmosolgo/graphql-ruby/commit/28233b16c0eb9d0fb7808f4980e061dc7507c4cd
  • article
    https://github.com/rmosolgo/graphql-ruby/commit/2d2f4ed1f79472f8eed29c864b039649e1de238f
  • article
    https://github.com/rmosolgo/graphql-ruby/commit/5c5a7b9a9bdce143be048074aea50edb7bb747be
  • article
    https://github.com/rmosolgo/graphql-ruby/commit/6eca16b9fa553aa957099a30dbde64ddcdac52ca
  • article
    https://github.com/rmosolgo/graphql-ruby/commit/d0963289e0dab4ea893bbecf12bb7d89294957bb
  • article
    https://github.com/rmosolgo/graphql-ruby/commit/d1117ae0361d9ed67e0795b07f5c3e98e62f3c7c
  • article
    https://github.com/rmosolgo/graphql-ruby/commit/e3b33ace05391da2871c75ab4d3b66e29133b367
  • article
    https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-q92j-grw3-h492
  • report
    https://access.redhat.com/security/cve/CVE-2025-27610
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-27610
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-27610
  • article
    https://github.com/rack/rack/commit/50caab74fa01ee8f5dbdee7bb2782126d20c6583
  • article
    https://github.com/rack/rack/security/advisories/GHSA-7wqh-767x-r66v