Red Hat Security Advisory: Satellite 6.19.1 Async Update

Fixed packages 3

Vulnerabilities 2

• Medium 6.4
  CVE-2026-32282

  TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix

  On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root. The Linux fchmodat syscall silently ignores the AT_SYMLINK_N…

  Go standard library internal/syscall/unix golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Apr 8, 2026
• Medium 5.4
  CVE-2026-4324

  Rubygem-katello: katello: denial of service and potential information disclosure via sql injection

  A flaw was found in the Katello plugin for Red Hat Satellite. This vulnerability, caused by improper sanitization of user-provided input, allows a remote attacker to inject arbitrary SQL commands into the sort_by parameter of the /api/hosts/bootc_images API e…

  Red Hat Red Hat Satellite 6 Red Hat Satellite 6.17 for RHEL 9 Red Hat Satellite 6.18 for RHEL 9 RubyGems
  Mar 17, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://issues.redhat.com/browse/SAT-40215
• article
  https://issues.redhat.com/browse/SAT-44554
• article
  https://issues.redhat.com/browse/SAT-45125
• article
  https://issues.redhat.com/browse/SAT-45126
• article
  https://issues.redhat.com/browse/SAT-45127
• article
  https://issues.redhat.com/browse/SAT-45128
• article
  https://issues.redhat.com/browse/SAT-45130
• article
  https://issues.redhat.com/browse/SAT-45131
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_22326.json
• report
  https://access.redhat.com/security/cve/CVE-2026-4324
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2448349
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-4324
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-4324
• report
  https://access.redhat.com/security/cve/CVE-2026-32282
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2456336
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-32282
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-32282
• article
  https://go.dev/cl/763761
• article
  https://go.dev/issue/78293
• article
  https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU
• advisory
  https://pkg.go.dev/vuln/GO-2026-4864