Skip to content
OpenAdvisories
Critical RHSA-2025:3491 3 CVEs

Red Hat Security Advisory: Satellite 6.15.5.2 Async Update

Published Apr 2, 2025 · Updated Oct 16, 2026

Ecosystem: Red Hat

Fixed packages 7

ReleasePackageFixed in
Red Hat · Satellite Capsule 6 satellite_capsule:6.15::el8 python-jinja2 0:3.1.5-1.el8pc
Red Hat · Satellite Capsule 6 satellite_capsule:6.15::el8 python3.11-jinja2 0:3.1.5-1.el8pc
Red Hat · Satellite Capsule 6 satellite_capsule:6.15::el8 rubygem-rack 0:2.2.13-1.el8sat
Red Hat · Satellite 6 satellite:6.15::el8 python-jinja2 0:3.1.5-1.el8pc
Red Hat · Satellite 6 satellite:6.15::el8 python3.11-jinja2 0:3.1.5-1.el8pc
Red Hat · Satellite 6 satellite:6.15::el8 rubygem-graphql 0:1.13.24-1.el8sat
Red Hat · Satellite 6 satellite:6.15::el8 rubygem-rack 0:2.2.13-1.el8sat

Vulnerabilities 3

  • Critical 9.1
    CVE-2025-27407 Public exploit

    Remote code execution when loading a crafted GraphQL schema

    graphql-ruby is a Ruby implementation of GraphQL. Starting in version 1.11.5 and prior to versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21, loading a malicious schema definition in `GraphQL::Schema.from_introspection` (or `GraphQL::Schema…

    rmosolgo graphql-ruby graphql ruby-graphql Debian Ubuntu RubyGems
  • High 7.5
    CVE-2025-27610

    Local File Inclusion in Rack::Static

    Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.13, 3.0.14, and 3.1.12, `Rack::Static` can serve files under the specified `root:` even if `urls:` are provided, which may expose other files under the specified `root:`…

    rack rack kube-fluentd-operator rack Debian Ubuntu Wolfi RubyGems
  • Medium 5.4
    CVE-2024-56201

    Jinja has a sandbox breakout through malicious filenames

    Jinja is an extensible templating engine. In versions on the 3.x branch prior to 3.1.5, a bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of if Jinja's sandbox…

    pallets jinja kserve-storage-controller kserve-agent Debian Ubuntu Azure Linux Alpine Wolfi PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • article
    https://access.redhat.com/documentation/en-us/red_hat_satellite/6.15/html/updating_red_hat_satellite/index
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2333854
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2351231
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2351767
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3491.json
  • report
    https://access.redhat.com/security/cve/CVE-2024-56201
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-56201
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-56201
  • article
    https://github.com/pallets/jinja/commit/767b23617628419ae3709ccfb02f9602ae9fe51f
  • article
    https://github.com/pallets/jinja/issues/1792
  • article
    https://github.com/pallets/jinja/releases/tag/3.1.5
  • article
    https://github.com/pallets/jinja/security/advisories/GHSA-gmj6-6f8f-6699
  • report
    https://access.redhat.com/security/cve/CVE-2025-27407
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-27407
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-27407
  • article
    https://github.com/github-community-projects/graphql-client
  • article
    https://github.com/rmosolgo/graphql-ruby/commit/28233b16c0eb9d0fb7808f4980e061dc7507c4cd
  • article
    https://github.com/rmosolgo/graphql-ruby/commit/2d2f4ed1f79472f8eed29c864b039649e1de238f
  • article
    https://github.com/rmosolgo/graphql-ruby/commit/5c5a7b9a9bdce143be048074aea50edb7bb747be
  • article
    https://github.com/rmosolgo/graphql-ruby/commit/6eca16b9fa553aa957099a30dbde64ddcdac52ca
  • article
    https://github.com/rmosolgo/graphql-ruby/commit/d0963289e0dab4ea893bbecf12bb7d89294957bb
  • article
    https://github.com/rmosolgo/graphql-ruby/commit/d1117ae0361d9ed67e0795b07f5c3e98e62f3c7c
  • article
    https://github.com/rmosolgo/graphql-ruby/commit/e3b33ace05391da2871c75ab4d3b66e29133b367
  • article
    https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-q92j-grw3-h492
  • report
    https://access.redhat.com/security/cve/CVE-2025-27610
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-27610
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-27610
  • article
    https://github.com/rack/rack/commit/50caab74fa01ee8f5dbdee7bb2782126d20c6583
  • article
    https://github.com/rack/rack/security/advisories/GHSA-7wqh-767x-r66v