Red Hat Security Advisory: Satellite 6.19.2 Async Update

Fixed packages 32

Vulnerabilities 13

• High 8.9
  CVE-2026-27727

  mchange-commons-java: Remote Code Execution via JNDI Reference Resolution

  mchange-commons-java, a library that provides Java utilities, includes code that mirrors early implementations of JNDI functionality, including support for remote `factoryClassLocation` values, by which code can be downloaded and invoked within a running appl…

  swaldman mchange-commons-java c3p0 com.mchange:mchange-commons-java Ubuntu Maven
  Feb 25, 2026
• High 8.8
  CVE-2026-5136

  Foreman: foreman: privilege escalation to administrator-level access via usergroup role assignment manipulation

  A flaw was found in Foreman. The Usergroup model in Foreman does not properly validate role assignments against the calling user's permissions. This allows an authenticated user with usergroup management permissions to attach arbitrary roles, including admini…

  Red Hat Red Hat Satellite 6 Red Hat Satellite 6.16 for RHEL 8 Red Hat Satellite 6.17 for RHEL 9
  Jul 1, 2026
• High 8.7
  CVE-2026-40192

  Pillow is vulnerable to a FITS GZIP decompression bomb

  Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memo…

  python-pillow Pillow open-webui kubeflow-pipelines-visualization-server Debian Ubuntu Wolfi PyPI
  Apr 15, 2026
• High 7.5
  CVE-2026-25679

  Incorrect parsing of IPv6 host literals in net/url

  url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

  Go standard library net/url langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi Go
  Mar 6, 2026
• High 7.5
  CVE-2026-32280

  Unexpected work during chain building in crypto/x509

  During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 an…

  Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Apr 8, 2026
• High 7.5
  CVE-2026-32281

  Inefficient policy validation in crypto/x509

  Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chain…

  Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Apr 8, 2026
• High 7.5
  CVE-2026-32283

  Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls

  If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.

  Go standard library crypto/tls golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Apr 8, 2026
• High 7.5
  CVE-2026-33810

  Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509

  When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certificate chains, issu…

  Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Apr 8, 2026
• High 7.4
  CVE-2026-48526

  PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed

  PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker t…

  jpadilla pyjwt kserve-storage-controller superset-6.0 Debian Ubuntu Azure Linux Wolfi PyPI
  May 28, 2026
• Medium 6.5
  CVE-2026-5135

  Foreman: foreman: unauthorized modification of host configurations via broken access control

  A flaw was found in Foreman. This broken access control vulnerability allows an authenticated user with host-edit permissions to retarget an existing lookup value override to a different host. This is achieved by modifying the match field through nested host …

  Red Hat Red Hat Satellite 6 Red Hat Satellite 6.16 for RHEL 8 Red Hat Satellite 6.17 for RHEL 9
  Jul 1, 2026
• Medium 6.5
  CVE-2026-5142

  Foreman: foreman: cross-tenant private ssh key disclosure via taxonomy scoping bypass

  A flaw was found in foreman. Authenticated users with 'view_keypairs' permission can bypass taxonomy scoping, allowing them to download private SSH (Secure Shell) keys from other organizations by directly querying key pair IDs. This vulnerability leads to cro…

  Red Hat Red Hat Satellite 6 Red Hat Satellite 6.16 for RHEL 8 Red Hat Satellite 6.17 for RHEL 9
  Jul 1, 2026
• Medium 6.4
  CVE-2026-32282

  TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix

  On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root. The Linux fchmodat syscall silently ignores the AT_SYMLINK_N…

  Go standard library internal/syscall/unix golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Apr 8, 2026
• Medium 4.3
  CVE-2026-5138

  Foreman: foreman: information disclosure via improper validation of nested request parameters

  A flaw was found in Foreman. An authenticated user with host-edit permissions could exploit a cross-tenant information disclosure vulnerability. This flaw occurs because the taxonomy_scope controller method does not properly validate organization and location…

  Red Hat Red Hat Satellite 6 Red Hat Satellite 6.16 for RHEL 8 Red Hat Satellite 6.17 for RHEL 9
  Jul 1, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://issues.redhat.com/browse/SAT-45957
• article
  https://issues.redhat.com/browse/SAT-46096
• article
  https://issues.redhat.com/browse/SAT-46097
• article
  https://issues.redhat.com/browse/SAT-46098
• article
  https://issues.redhat.com/browse/SAT-46101
• article
  https://issues.redhat.com/browse/SAT-46102
• article
  https://issues.redhat.com/browse/SAT-46103
• article
  https://issues.redhat.com/browse/SAT-46106
• article
  https://issues.redhat.com/browse/SAT-46107
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_34365.json
• report
  https://access.redhat.com/security/cve/CVE-2026-5135
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2452230
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-5135
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-5135
• report
  https://access.redhat.com/security/cve/CVE-2026-5136
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2452970
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-5136
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-5136
• report
  https://access.redhat.com/security/cve/CVE-2026-5138
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2452971
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-5138
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-5138
• report
  https://access.redhat.com/security/cve/CVE-2026-5142
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2452999
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-5142
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-5142
• report
  https://access.redhat.com/security/cve/CVE-2026-25679
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2445356
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-25679
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-25679
• article
  https://go.dev/cl/752180
• article
  https://go.dev/issue/77578
• article
  https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk
• advisory
  https://pkg.go.dev/vuln/GO-2026-4601
• report
  https://access.redhat.com/security/cve/CVE-2026-27727
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2442671
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-27727
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-27727