Skip to content
OpenAdvisories
Critical RHSA-2026:63385 22 CVEs

Red Hat Security Advisory: Satellite 6.19.4 Async Update

Published Sep 4, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 18

ReleasePackageFixed in
Red Hat · Satellite Capsule 6 satellite_capsule:6.19::el9 ansible-core 1:2.16.19-1.el9sat
Red Hat · Satellite Capsule 6 satellite_capsule:6.19::el9 ansible-test 1:2.16.19-1.el9sat
Red Hat · Satellite Capsule 6 satellite_capsule:6.19::el9 openvox-server 0:8.15.2-1.el9sat
Red Hat · Satellite Capsule 6 satellite_capsule:6.19::el9 python3.12-aiohttp 0:3.14.3-1.el9pc
Red Hat · Satellite Capsule 6 satellite_capsule:6.19::el9 python3.12-aiohttp-debuginfo 0:3.14.3-1.el9pc
Red Hat · Satellite Capsule 6 satellite_capsule:6.19::el9 python3.12-aiohttp-debugsource 0:3.14.3-1.el9pc
Red Hat · Satellite Capsule 6 satellite_capsule:6.19::el9 python3.12-gitpython 0:3.1.59-1.el9pc
Red Hat · Satellite Capsule 6 satellite_capsule:6.19::el9 rubygem-jwt 0:2.10.3-1.el9sat
Red Hat · Satellite Maintenance 6 satellite_maintenance:6.19::el9 ansible-core 1:2.16.19-1.el9sat
Red Hat · Satellite Utils 6 satellite_utils:6.19::el9 rubygem-jwt 0:2.10.3-1.el9sat
Red Hat · Satellite 6 satellite:6.19::el9 ansible-core 1:2.16.19-1.el9sat
Red Hat · Satellite 6 satellite:6.19::el9 ansible-test 1:2.16.19-1.el9sat
Red Hat · Satellite 6 satellite:6.19::el9 openvox-server 0:8.15.2-1.el9sat
Red Hat · Satellite 6 satellite:6.19::el9 python3.12-aiohttp 0:3.14.3-1.el9pc
Red Hat · Satellite 6 satellite:6.19::el9 python3.12-aiohttp-debuginfo 0:3.14.3-1.el9pc
Red Hat · Satellite 6 satellite:6.19::el9 python3.12-aiohttp-debugsource 0:3.14.3-1.el9pc
Red Hat · Satellite 6 satellite:6.19::el9 python3.12-gitpython 0:3.1.59-1.el9pc
Red Hat · Satellite 6 satellite:6.19::el9 rubygem-jwt 0:2.10.3-1.el9sat

Vulnerabilities 22

  • Critical 9.1
    CVE-2026-45363

    `jwt` (Ruby gem) - empty-key HMAC bypass

    ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. Prior to 2.10.3 and 3.2.0, JWT.decode(token, '', true, algorithm: 'HS256') accepts an attacker-forged token because OpenSSL::HMAC.digest('SHA256', '', payload) returns a valid di…

    jwt ruby-jwt kube-fluentd-operator ruby3.4-kube-logging-operator-fluentd-outputs Debian Ubuntu Wolfi RubyGems
  • High 8.8
    CVE-2026-42215

    GitPython: Command injection via Git options bypass

    GitPython is a python library used to interact with Git repositories. From version 3.1.30 to before version 3.1.47, GitPython blocks dangerous Git options such as --upload-pack and --receive-pack by default, but the equivalent Python kwargs upload_pack and re…

    gitpython-developers GitPython open-webui checkov Debian Ubuntu Alpine Wolfi PyPI
  • High 8.8
    CVE-2026-73625

    GitPython before 3.1.54 Remote Code Execution via kwarg value smuggling

    GitPython versions before 3.1.54 contain a remote code execution vulnerability in the check_unsafe_options guard that can be bypassed by smuggling git options inside single-character kwarg values. Attackers can supply crafted option dictionaries to clone_from…

    gitpython-developers GitPython gitpython python-git Debian Ubuntu PyPI
  • High 8.8
    CVE-2026-76220

    GitPython before 3.1.58 Command Execution via split_single_char_options

    GitPython before 3.1.58 contains a command execution vulnerability in the check_unsafe_options guard that can be bypassed by combining a single-character kwarg with split_single_char_options=False. Attackers can supply a crafted kwargs dictionary to guarded m…

    gitpython-developers GitPython checkov gitpython Debian Ubuntu Alpine Wolfi PyPI
  • High 8.8
    CVE-2026-76221

    GitPython before 3.1.58 Config Injection via option-name

    GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbols, and whitespace into option names. Attackers can inject …

    gitpython-developers GitPython gitpython python-git Debian Ubuntu Alpine PyPI
  • High 8.7
    CVE-2026-68494

    jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq)

    The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser) is incomplete. This record covers the remaining bypass. The earlier fix wired validateIntegerLength() into …

    FasterXML jackson-core druid trino Ubuntu Wolfi Maven
  • High 8.2
    CVE-2026-76222

    GitPython before 3.1.58 Path Traversal via .gitmodules Submodule Name

    GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git repositories at arbitrary filesystem paths outside the intended clone directory. Attackers can craft malicious repositories with traversal seque…

    gitpython-developers GitPython checkov gitpython Debian Ubuntu Alpine Wolfi PyPI
  • High 8.1
    CVE-2026-42284

    GitPython: Unsafe option check validates multi_options before shlex.split transforms it

    GitPython is a python library used to interact with Git repositories. Prior to version 3.1.47, _clone() validates multi_options as the original list, then executes shlex.split(" ".join(multi_options)). A string like "--branch main --config core.hooksPath=/x" …

    gitpython-developers GitPython open-webui checkov Debian Ubuntu Alpine Wolfi PyPI
  • High 8.1
    CVE-2026-54512 Public exploit

    jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation

    jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymor…

    FasterXML jackson-databind druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • High 8.1
    CVE-2026-73620

    GitPython before 3.1.57 Arbitrary File Overwrite and Read

    GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout() and TagReference.create(), allowing attackers to pass unsafe options via kwargs. Attackers can use --prefix to overwrite arbitrary files with repository content or -F to read…

    gitpython-developers GitPython gitpython python-git Debian Ubuntu PyPI
  • High 8.1
    CVE-2026-73624

    GitPython before 3.1.54 Arbitrary File Overwrite via diff

    GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the Diffable.diff method that fails to validate git options passed through kwargs. Attackers can supply the --output argument via the other parameter or output kwarg to writ…

    gitpython-developers GitPython gitpython python-git Debian Ubuntu PyPI
  • High 8.1
    CVE-2026-76219

    GitPython before 3.1.58 Arbitrary File Overwrite via read-tree

    GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in IndexFile.from_tree, IndexFile.reset, and IndexFile.merge_tree methods that append caller-influenced treeish strings to git read-tree without option validation or argument s…

    gitpython-developers GitPython checkov gitpython Debian Ubuntu Alpine Wolfi PyPI
  • High 7.8
    CVE-2026-11332

    Ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution

    A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git con…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 Linux Debian Ubuntu Azure Linux PyPI
  • High 7.8
    CVE-2026-16493

    Ansible-core: argument injection in ansible-galaxy collection install via git clone (incomplete fix for cve-2026-11332)

    A flaw was found in ansible-core. The _extract_collection_from_git() function in ansible-core's concrete_artifact_manager.py constructs git clone commands without a '--' (end-of-options) separator before user-supplied URLs when installing collections from git…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-44244

    GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath

    GitPython is a python library used to interact with Git repositories. Prior to version 3.1.49, GitConfigParser.set_value() passes values to Python's configparser without validating for newlines. GitPython's own _write() converts embedded newlines into indente…

    gitpython-developers GitPython gitpython python-git Debian Ubuntu PyPI
  • High 7.5
    CVE-2026-73622

    GitPython before 3.1.55 Environment Variable Exfiltration via Remote.add()

    GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment v…

    gitpython-developers GitPython gitpython python-git Debian Ubuntu PyPI
  • High 7.5
    CVE-2026-73623

    GitPython before 3.1.54 Remote Code Execution via --template

    GitPython before 3.1.54 contains an incomplete denylist in unsafe_git_clone_options that omits --template, allowing attackers to achieve arbitrary command execution during clone operations. Attackers can supply --template pointing to a directory containing ma…

    gitpython-developers GitPython gitpython python-git Debian Ubuntu PyPI
  • High 7.5
    CVE-2026-76218

    GitPython before 3.1.58 Remote Code Execution via Repo.init

    GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards unsafe git options without validation. Attackers can supply a template parameter pointing to a directory with malicious git hooks that execute arbitrary code whe…

    gitpython-developers GitPython checkov gitpython Debian Ubuntu Alpine Wolfi PyPI
  • High 7.1
    CVE-2026-69244

    AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)

    AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possib…

    aio-libs aiohttp open-webui airflow-3 Debian Ubuntu Azure Linux Wolfi PyPI
  • Medium 6.9
    CVE-2026-10051

    Eclipse Jetty: Cross-Request Leakage for trailers on HTTP/1.1 keep-alive connections

    In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection. Subsequent request that do not have trailers report the trailers of the first request. Subsequent requ…

    Eclipse Foundation Eclipse Jetty druid trino Debian Ubuntu Wolfi Maven
  • Medium 6.4
    CVE-2026-34993

    AIOHTTP Vulnerable to Deserialization of Untrusted Data

    AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using ``CookieJar.load()`` with untrusted input may allow arbitrary code execution. Most applications using this function will be doing so with the user's…

    aio-libs aiohttp open-webui katib-earlystopping Debian Ubuntu Azure Linux Wolfi PyPI
  • Medium 6.3
    CVE-2026-69243 Public exploit

    AIOHTTP: HTTP request smuggling via WebSocket upgrade

    AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to exec…

    aio-libs aiohttp open-webui airflow-3 Debian Ubuntu Azure Linux Wolfi PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • article
    https://issues.redhat.com/browse/SAT-45592
  • article
    https://issues.redhat.com/browse/SAT-46105
  • article
    https://issues.redhat.com/browse/SAT-48574
  • article
    https://issues.redhat.com/browse/SAT-48584
  • article
    https://issues.redhat.com/browse/SAT-48585
  • article
    https://issues.redhat.com/browse/SAT-48586
  • article
    https://issues.redhat.com/browse/SAT-48587
  • article
    https://issues.redhat.com/browse/SAT-48588
  • article
    https://issues.redhat.com/browse/SAT-48589
  • article
    https://issues.redhat.com/browse/SAT-48628
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_63385.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-10051
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2499928
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-10051
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-10051
  • article
    https://gitlab.eclipse.org/security/cve-assignment/-/work_items/119
  • report
    https://access.redhat.com/security/cve/CVE-2026-11332
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2485379
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-11332
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-11332
  • article
    https://github.com/ansible/ansible
  • report
    https://access.redhat.com/security/cve/CVE-2026-16493
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2503724
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-16493
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-16493
  • report
    https://access.redhat.com/security/cve/CVE-2026-34993
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2484099
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-34993
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-34993
  • article
    https://github.com/aio-libs/aiohttp/commit/dcf40f30637e8752c76781cf6703b5a236749a00
  • article
    https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jg22-mg44-37j8
  • report
    https://access.redhat.com/security/cve/CVE-2026-42215
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2467802
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-42215
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-42215
  • article
    https://github.com/gitpython-developers/GitPython/releases/tag/3.1.47
  • article
    https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rpm5-65cw-6hj4
  • report
    https://access.redhat.com/security/cve/CVE-2026-42284