Skip to content
OpenAdvisories
Medium RLSA-2022:5498 28 CVEs

Moderate: Satellite 6.11 Release

Published Jul 5, 2022 · Updated Feb 5, 2026

Ecosystem: Rocky Linux

Summary

Rocky Enterprise Software Foundation Satellite is a systems management tool for Linux-based
infrastructure. It allows for provisioning, remote management, and
monitoring of multiple Linux deployments with a single centralized tool.

Security Fix(es):

* libsolv: Heap-based buffer overflow in testcase_read() in src/testcase.c (CVE-2021-3200)
* satellite: foreman: Authenticate remote code execution through Sendmail configuration (CVE-2021-3584)
* candlepin: Allow unintended SCA certificate to authenticate Candlepin (CVE-2021-4142)
* candlepin: netty: Information disclosure via the local system temporary directory (CVE-2021-21290)
* candlepin: netty: Possible request smuggling in HTTP/2 due missing validation (CVE-2021-21295)
* candlepin: netty: Request smuggling via content-length header (CVE-2021-21409)
* tfm-rubygem-sidekiq: XSS via the queue name of the live-poll feature (CVE-2021-30151)
* python-sqlparse: ReDoS via regular expression in StripComments filter (CVE-2021-32839)
* libsolv: various flaws (CVE-2021-33928 CVE-2021-33929 CVE-2021-33930 CVE-2021-33938)
* tfm-rubygem-puma: Inconsistent Interpretation of HTTP Requests in puma (CVE-2021-41136)
* logback-classic: Remote code execution through JNDI call from within its configuration file (CVE-2021-42550)
* candlepin: netty: Control chars in header names may lead to HTTP request smuggling (CVE-2021-43797)
* python-lxml: HTML Cleaner allows crafted and SVG embedded scripts to pass through (CVE-2021-43818)
* python3-django: Potential bypass of an upstream access control based on URL paths (CVE-2021-44420)
* libsolv: Heap overflow (CVE-2021-44568)
* python3-django: Various flaws (CVE-2021-45115 CVE-2021-45116 CVE-2021-45452 CVE-2022-22818)
* tfm-rubygem-actionpack: Information leak between requests (CVE-2022-23633)
* tfm-rubygem-puma: rubygem-rails: Information leak between requests (CVE-2022-23634)
* python3-django: Denial-of-service possibility in file uploads (CVE-2022-23833)
* tfm-rubygem-sidekiq: WebUI Denial of Service caused by number of days on graph (CVE-2022-23837)
* python3-django: Various flaws (CVE-2022-28346 CVE-2022-28347)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Additional Changes:

* New repo layout for Satellite, Utils, Maintenance, and Client repos.
* Support for Rocky Linux 9 clients
* Module-based installation on Rocky Linux 8
* Upgrading Satellite Server and Capsule Server installations from Rocky Linux 7 to Rocky Linux 8
* Connected and Disconnected servers supported on Rocky Linux 7 and Rocky Linux 8
* Inter-Server Synchronization improvements
* Puppet integration optional and disabled by default
* Pulp 3 updated to Python 3.8
* Change to Capsule certificate archive
* New default port for communication with Rocky Enterprise Software Foundation Subscription Management * (RHSM) API on Capsule servers
* New Content Views Page (Content Publication workflow simplification)
* New Hosts Page (Technology Preview)
* Registration and preview templates
* Simplified host content source changing
* Improved behavior for configuring and running remote jobs
* Provisioning improvements
* New error signaling unsupported options in TASK-Filter
* Virt-who configuration enhanced to support Nutanix AHV
* Cloud Connector configuration updated
* Improved Insights adoption

The items above are not a complete list of changes. This update also fixes
several bugs and adds various enhancements. Documentation for these changes
is available from the Release Notes document linked to in the References
section.

Fixed packages 1

ReleasePackageFixed in
Rocky Linux · 8 libdb 0:5.3.28-42.el8_4

Vulnerabilities 28

  • Critical 9.8
    CVE-2022-28346 Public exploit EPSS 19%

    SQL Injection in Django

    An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a crafted dictionary (with dictionary expansion) as the pass…

    python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  • Critical 9.8
    CVE-2022-28347

    SQL Injection in Django

    A SQL injection issue was discovered in QuerySet.explain() in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. This occurs by passing a crafted dictionary (with dictionary expansion) as the **options argument, and placing the injection paylo…

    python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  • High 8.2
    CVE-2021-43818

    HTML Cleaner allows crafted and SVG embedded scripts to pass through

    lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs. Users that employ th…

    lxml lxml lxml lxml Debian Ubuntu Azure Linux Alpine PyPI
  • High 8.0
    CVE-2022-23634

    Information Exposure when using Puma with Rails

    Puma is a Ruby/Rack web server built for parallelism. Prior to `puma` version `5.6.2`, `puma` may not always call `close` on the response body. Rails, prior to version `7.0.2.2`, depended on the response body being closed in order for its `CurrentAttributes` …

    puma puma puma puma Debian Ubuntu RubyGems
  • High 7.5
    CVE-2021-32839

    Regular Expression Denial of Service in sqlparse

    sqlparse is a non-validating SQL parser module for Python. In sqlparse versions 0.4.0 and 0.4.1 there is a regular Expression Denial of Service in sqlparse vulnerability. The regular expression may cause exponential backtracking on strings containing many rep…

    andialbrecht sqlparse sqlparse sqlparse Debian Ubuntu Alpine PyPI
  • High 7.5
    CVE-2021-45115

    Denial-of-service in Django

    An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. UserAttributeSimilarityValidator incurred significant overhead in evaluating a submitted password that was artificially large in relation to the comparison values. I…

    python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  • High 7.5
    CVE-2021-45116

    Information disclosure in Django

    An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Due to leveraging the Django Template Language's variable resolution logic, the dictsort template filter was potentially vulnerable to information disclosure, or an …

    python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  • High 7.5
    CVE-2022-23833 EPSS 50%

    Infinite Loop in Django

    An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2. Passing certain inputs to multipart forms could result in an infinite loop when parsing files.

    python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  • High 7.5
    CVE-2022-23837

    Denial of service in sidekiq

    In api.rb in Sidekiq before 5.2.10 and 6.4.0, there is no limit on the number of days when requesting stats for the graph. This overloads the system, affecting the Web UI, and makes it unavailable to users.

    sidekiq ruby-sidekiq ruby-sidekiq Debian Ubuntu RubyGems
  • High 7.4
    CVE-2022-23633

    Exposure of sensitive information in Action Pack

    Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local stat…

    rails rails rails rails Debian Ubuntu RubyGems
  • High 7.3
    CVE-2021-44420

    Potential bypass of an upstream access control based on URL paths in Django

    In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths.

    python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  • Medium 6.6
    CVE-2021-42550

    RCE from attacker with configuration edit priviledges through JNDI lookup

    In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP servers.

    QOS.ch logback logback logback Debian Ubuntu Maven
  • Medium 6.5
    CVE-2021-43797

    HTTP fails to validate against control chars in header names which may lead to HTTP request smuggling

    Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the …

    netty netty netty netty Debian Ubuntu Maven
  • Medium 6.2
    CVE-2021-21290

    Local Information Disclosure Vulnerability in Netty on Unix-Like systems due temporary files

    Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty before version 4.1.59.Final there is a vulnerability on Unix-like systems involving an…

    netty netty netty netty Debian Ubuntu Maven
  • Medium 6.1
    CVE-2021-30151 Scanner template

    Cross-site Scripting in Sidekiq

    Sidekiq through 5.1.3 and 6.x through 6.2.0 allows XSS via the queue name of the live-poll feature when Internet Explorer is used.

    sidekiq ruby-sidekiq ruby-sidekiq Debian Ubuntu RubyGems
  • Medium 6.1
    CVE-2022-22818 Public exploit

    Cross-site Scripting in Django

    The {% debug %} template tag in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2 does not properly encode the current context. This may lead to XSS.

    python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  • Medium 5.9
    CVE-2021-21295 EPSS 19%

    Possible request smuggling in HTTP/2 due missing validation

    Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.60.Final there is a vulnerability that…

    netty io.netty:netty-codec-http2 netty netty Debian Ubuntu Maven
  • Medium 5.9
    CVE-2021-21409

    Possible request smuggling in HTTP/2 due missing validation of content-length

    Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there is a vulnerability that…

    netty netty netty netty Debian Ubuntu Maven
  • Medium 5.3
    CVE-2021-45452

    Directory-traversal in Django

    Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it.

    python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  • Low 3.7
    CVE-2021-41136

    Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in puma

    Puma is a HTTP 1.1 server for Ruby/Rack applications. Prior to versions 5.5.1 and 4.3.9, using `puma` with a proxy which forwards HTTP header values which contain the LF character could allow HTTP request smugggling. A client could smuggle a request through a…

    puma puma puma puma Debian RubyGems
  • Unscored —
    CVE-2021-3200

    Buffer overflow vulnerability in libsolv 2020-12-13 via the Solver * testcase_read(Pool *pool, FILE *fp, const char *te…

    libsolv libsolv Debian Ubuntu
  • Unscored —
    CVE-2021-33928

    Buffer overflow vulnerability in function pool_installable in src/repo.h in libsolv before 0.7.17 allows attackers to c…

    libsolv libsolv Debian Ubuntu
  • Unscored —
    CVE-2021-33929

    Buffer overflow vulnerability in function pool_disabled_solvable in src/repo.h in libsolv before 0.7.17 allows attacker…

    libsolv libsolv Debian Ubuntu
  • Unscored —
    CVE-2021-33930

    Buffer overflow vulnerability in function pool_installable_whatprovides in src/repo.h in libsolv before 0.7.17 allows a…

    libsolv libsolv Debian Ubuntu
  • Unscored —
    CVE-2021-33938

    Buffer overflow vulnerability in function prune_to_recommended in src/policy.c in libsolv before 0.7.17 allows attacker…

    libsolv libsolv Debian Ubuntu
  • Unscored —
    CVE-2021-3584

    A server side remote code execution vulnerability was found in Foreman project. A authenticated attacker could use Send…

  • Unscored —
    CVE-2021-4142

    The Candlepin component of Red Hat Satellite was affected by an improper authentication flaw. Few factors could allow a…

  • Unscored —
    CVE-2021-44568

    Two heap-overflow vulnerabilities exist in openSUSE/libsolv libsolv through 13 Dec 2020 in the decisionmap variable via…

    libsolv libsolv Debian Ubuntu

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1459231
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1473263
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1545000
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1596004
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1609543
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1659649
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1662924
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1685708
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1693733
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1694659
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1713401
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1723632
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1723751
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1735540
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1744521
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1761421
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1770075
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1771724
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1777820
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1784254
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1805028
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1807258
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1807536
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1809769
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1811166
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1813624
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1819309
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1825761
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1832858
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1844848
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1845471
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1847825
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1851808
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1852897
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1862140
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1867193
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1869351
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1872688
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1873241