Skip to content
OpenAdvisories
High RHSA-2026:50263 10 CVEs

Red Hat Security Advisory: Satellite 6.18.8 Async Update

Published Aug 5, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 23

ReleasePackageFixed in
Red Hat · Satellite Capsule 6 satellite_capsule:6.18::el9 openvox-agent 0:8.24.1-3.el9sat
Red Hat · Satellite Capsule 6 satellite_capsule:6.18::el9 openvox-server 0:8.14.1-1.el9sat
Red Hat · Satellite Capsule 6 satellite_capsule:6.18::el9 python3.12-pillow 0:12.3.0-1.el9pc
Red Hat · Satellite Capsule 6 satellite_capsule:6.18::el9 python3.12-pillow-debuginfo 0:12.3.0-1.el9pc
Red Hat · Satellite Capsule 6 satellite_capsule:6.18::el9 python3.12-pillow-debugsource 0:12.3.0-1.el9pc
Red Hat · Satellite Capsule 6 satellite_capsule:6.18::el9 python3.12-pyjwt 0:2.13.0-1.el9pc
Red Hat · Satellite Capsule 6 satellite_capsule:6.18::el9 python3.12-pyjwt+crypto 0:2.13.0-1.el9pc
Red Hat · Satellite Capsule 6 satellite_capsule:6.18::el9 rubygem-faraday 0:1.10.6-1.el9sat
Red Hat · Satellite Capsule 6 satellite_capsule:6.18::el9 rubygem-nokogiri 0:1.15.7-3.el9sat
Red Hat · Satellite Capsule 6 satellite_capsule:6.18::el9 rubygem-nokogiri-debuginfo 0:1.15.7-3.el9sat
Red Hat · Satellite Capsule 6 satellite_capsule:6.18::el9 rubygem-nokogiri-debugsource 0:1.15.7-3.el9sat
Red Hat · Satellite 6 satellite:6.18::el9 openvox-agent 0:8.24.1-3.el9sat
Red Hat · Satellite 6 satellite:6.18::el9 openvox-server 0:8.14.1-1.el9sat
Red Hat · Satellite 6 satellite:6.18::el9 python3.12-pillow 0:12.3.0-1.el9pc
Red Hat · Satellite 6 satellite:6.18::el9 python3.12-pillow-debuginfo 0:12.3.0-1.el9pc
Red Hat · Satellite 6 satellite:6.18::el9 python3.12-pillow-debugsource 0:12.3.0-1.el9pc
Red Hat · Satellite 6 satellite:6.18::el9 python3.12-pyjwt 0:2.13.0-1.el9pc
Red Hat · Satellite 6 satellite:6.18::el9 python3.12-pyjwt+crypto 0:2.13.0-1.el9pc
Red Hat · Satellite 6 satellite:6.18::el9 rubygem-faraday 0:1.10.6-1.el9sat
Red Hat · Satellite 6 satellite:6.18::el9 rubygem-katello 0:4.18.0.15-1.el9sat
Red Hat · Satellite 6 satellite:6.18::el9 rubygem-nokogiri 0:1.15.7-3.el9sat
Red Hat · Satellite 6 satellite:6.18::el9 rubygem-nokogiri-debuginfo 0:1.15.7-3.el9sat
Red Hat · Satellite 6 satellite:6.18::el9 rubygem-nokogiri-debugsource 0:1.15.7-3.el9sat

Vulnerabilities 10

  • Critical 9.8
    CVE-2025-9230

    Out-of-bounds read & write in RFC 3211 KEK Unwrap

    Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-54059

    Pillow: PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading

    Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_check(), allowing crafted PCF fo…

    python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI
  • High 7.5
    CVE-2026-54060

    Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`

    Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new("1", (xsize, ysize)) without calling Image._decompression_bomb_check(), allowing a font to trigger excessi…

    python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI
  • High 7.5
    CVE-2026-54297

    Faraday: Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parameters

    Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. From 1.0.0 until 1.10.6 and 2.14.3, Faraday::NestedParamsEncoder, the default nested query parameter encoder/decoder in Faraday, decodes nested query stri…

    lostisland faraday logstash-9.3 logstash-9.3-iamguarded-compat Debian Ubuntu Wolfi RubyGems
  • High 7.5
    CVE-2026-55379

    Pillow BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading

    Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() without calling Image._decompression_bomb_check(), bypassing P…

    python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI
  • High 7.5
    CVE-2026-55380

    Pillow GdImageFile decompression bomb protection bypass

    Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open() read image dimensions from the GD 2.x header and stored them in self._size without calling Image._decompression_bomb_check(), allowing a crafted .gd file to trigger ex…

    python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI
  • High 7.4
    CVE-2026-2332 Public exploit

    HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

    In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here: * https://w4ke.info/2025/06/18/funky-chunks.html * https://w4ke.info/2025/10/29/funky-chunks-2.htm…

    Eclipse Foundation Eclipse Jetty druid trino Debian Ubuntu Wolfi Maven
  • High 7.4
    CVE-2026-48526

    PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed

    PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker t…

    jpadilla pyjwt kserve-storage-controller superset-6.0 Debian Ubuntu Azure Linux Wolfi PyPI
  • Medium 4.3
    CVE-2026-12515

    Katello: missing repository authorization in content_uploads exposes cross-product content existence

    A flaw was found in Katello's of Red Hat Satellite. A content upload functionality where insufficient authorization checks in the ContentUploadsController allowed users with the edit_products permission to query content information for repositories outside th…

    Red Hat Red Hat Hardened Images Red Hat Satellite 6 Red Hat Satellite 6.16 for RHEL 8 RubyGems
  • Low 1.7
    CVE-2026-57236

    Nokogiri: Possible Use-After-Free when `Nokogiri::XML::Document#encoding=` raises an exception

    Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, calling Document#encoding= with an invalid encoding (e.g., a non-string, or a string containing a null byte) raises an exception, but only after freeing the do…

    sparklemotion nokogiri nokogiri ruby-nokogiri Debian Ubuntu Azure Linux Alpine RubyGems

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2396054
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2458187
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2482734
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2489812
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492252
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492952
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2497452
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2497455
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2497464
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2497466
  • article
    https://issues.redhat.com/browse/SAT-44866
  • article
    https://issues.redhat.com/browse/SAT-48160
  • article
    https://issues.redhat.com/browse/SAT-48161
  • article
    https://issues.redhat.com/browse/SAT-48162
  • article
    https://issues.redhat.com/browse/SAT-48302
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50263.json
  • report
    https://access.redhat.com/security/cve/CVE-2025-9230
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-9230
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-9230
  • report
    https://access.redhat.com/security/cve/CVE-2026-2332
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-2332
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-2332
  • article
    https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf
  • article
    https://gitlab.eclipse.org/security/cve-assignment/-/issues/89
  • report
    https://access.redhat.com/security/cve/CVE-2026-12515
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-12515
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-12515
  • article
    https://github.com/Katello/katello/pull/11712
  • report
    https://access.redhat.com/security/cve/CVE-2026-48526
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-48526
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-48526
  • article
    https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx
  • report
    https://access.redhat.com/security/cve/CVE-2026-54059
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-54059
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-54059
  • article
    https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst
  • article
    https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d
  • article
    https://github.com/python-pillow/Pillow/security/advisories/GHSA-8v84-f9pq-wr9x