Red Hat Security Advisory: Satellite 6.18.5 Async Update

Fixed packages 8

Vulnerabilities 8

• High 7.5
  CVE-2025-14550

  Potential denial-of-service vulnerability via repeated headers when using ASGI

  An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `ASGIRequest` allows a remote attacker to cause a potential denial-of-service via a crafted request with multiple duplicate headers. Earlier, unsupported Django series (suc…

  djangoproject Django asgiref python-django Debian Ubuntu Alpine PyPI
  Feb 3, 2026
• High 7.5
  CVE-2025-69534

  Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParse…

  python3.4 python3.5 python2.7 python3.6 Debian Ubuntu Wolfi PyPI
  Mar 5, 2026
• High 7.5
  CVE-2026-1285

  Potential denial-of-service vulnerability in django.utils.text.Truncator HTML methods

  An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `django.utils.text.Truncator.chars()` and `Truncator.words()` methods (with `html=True`) and the `truncatechars_html` and `truncatewords_html` template filters allow a remo…

  djangoproject Django python-django django Debian Ubuntu Alpine PyPI
  Feb 3, 2026
• High 7.2
  CVE-2026-27459

  pyOpenSSL DTLS cookie callback buffer overflow

  pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to `set_cookie_generate_callback` returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL…

  pyca pyopenssl airflow-3 py3-cassandra-medusa Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  Mar 17, 2026
• Medium 6.6
  CVE-2026-33176

  Rails Active Support has a possible DoS vulnerability in its number helpers

  Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Support number helpers accept strings containing scientific notation (e.g. `1e10000`), which …

  rails activesupport rails kube-fluentd-operator Debian Ubuntu Wolfi RubyGems
  Mar 23, 2026
• Medium 5.4
  CVE-2026-1207 Public exploit Scanner template EPSS 13%

  Potential SQL injection via raster lookups on PostGIS

  An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on ``RasterField`` (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter. Earlier, unsupported Django series (such…

  djangoproject Django python-django django Debian Ubuntu Alpine PyPI
  Feb 3, 2026
• Medium 5.4
  CVE-2026-1287

  Potential SQL injection in column aliases via control characters

  An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `FilteredRelation` is subject to SQL injection in column aliases via control characters, using a suitably crafted dictionary, with dictionary expansion, as the `**kwargs` p…

  djangoproject Django python-django django Debian Ubuntu Alpine PyPI
  Feb 3, 2026
• Medium 5.4
  CVE-2026-1312 Public exploit

  Potential SQL injection via QuerySet.order_by and FilteredRelation

  An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `.QuerySet.order_by()` is subject to SQL injection in column aliases containing periods when the same alias is, using a suitably crafted dictionary, with dictionary expansi…

  djangoproject Django python-django django Debian Ubuntu Alpine PyPI
  Feb 3, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://access.redhat.com/documentation/en-us/red_hat_satellite/6.18/html/updating_red_hat_satellite/index
• article
  https://issues.redhat.com/browse/SAT-37836
• article
  https://issues.redhat.com/browse/SAT-43946
• article
  https://issues.redhat.com/browse/SAT-43947
• article
  https://issues.redhat.com/browse/SAT-43948
• article
  https://issues.redhat.com/browse/SAT-43949
• article
  https://issues.redhat.com/browse/SAT-43950
• article
  https://issues.redhat.com/browse/SAT-43951
• article
  https://issues.redhat.com/browse/SAT-43952
• article
  https://issues.redhat.com/browse/SAT-43953
• article
  https://issues.redhat.com/browse/SAT-43954
• article
  https://issues.redhat.com/browse/SAT-43955
• article
  https://issues.redhat.com/browse/SAT-43956
• article
  https://issues.redhat.com/browse/SAT-43958
• article
  https://issues.redhat.com/browse/SAT-43959
• article
  https://issues.redhat.com/browse/SAT-43960
• article
  https://issues.redhat.com/browse/SAT-43962
• article
  https://issues.redhat.com/browse/SAT-43963
• article
  https://issues.redhat.com/browse/SAT-44062
• article
  https://issues.redhat.com/browse/SAT-44760
• article
  https://issues.redhat.com/browse/SAT-44761
• article
  https://issues.redhat.com/browse/SAT-44762
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_14835.json
• report
  https://access.redhat.com/security/cve/CVE-2025-14550
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2436341
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-14550
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-14550
• article
  https://docs.djangoproject.com/en/dev/releases/security/
• article
  https://groups.google.com/g/django-announce
• article
  https://www.djangoproject.com/weblog/2026/feb/03/security-releases/
• report
  https://access.redhat.com/security/cve/CVE-2025-69534
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2444839
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-69534
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-69534
• article
  https://github.com/Python-Markdown/markdown
• article
  https://github.com/Python-Markdown/markdown/actions/runs/15736122892
• article
  https://github.com/Python-Markdown/markdown/issues/1534
• report
  https://access.redhat.com/security/cve/CVE-2026-1207