RHSA-2018:2927HighCVSS 8.1

Red Hat Security Advisory: Satellite 6.4 security, bug fix, and enhancement update

Published
October 16, 2018
Last Modified
August 4, 2026

🔗 CVE IDs covered (28)

CVE-2016-1000338 →CVE-2016-1000341 →CVE-2016-1000344 →CVE-2016-1000352 →CVE-2018-1090 →CVE-2018-1096 →CVE-2018-5382 →CVE-2018-10237 →CVE-2015-6644 →CVE-2016-1000339 →CVE-2016-1000342 →CVE-2016-1000343 →CVE-2016-1000345 →CVE-2017-10690 →CVE-2017-12175 →CVE-2018-7536 →CVE-2016-1000340 →CVE-2017-5929 →CVE-2017-7536 →CVE-2017-10689 →CVE-2018-1097 →CVE-2018-6188 →CVE-2015-3208 · pendingCVE-2016-1000346 →CVE-2017-7233 →CVE-2017-15095 →CVE-2017-15100 →CVE-2018-7537 →

📋 Description

CVE-2015-3208 — hornetq: XXE/SSRF in XPath selector CVE-2015-6644 — bouncycastle: Information disclosure in GCMBlockCipher CVE-2016-1000338 — bouncycastle: DSA does not fully validate ASN.1 encoding during signature verification allowing for injection of unsigned data CVE-2016-1000339 — bouncycastle: Information leak in AESFastEngine class CVE-2016-1000340 — bouncycastle: Carry propagation bug in math.raw.Nat??? class CVE-2016-1000341 — bouncycastle: Information exposure in DSA signature generation via timing attack CVE-2016-1000342 — bouncycastle: ECDSA improper validation of ASN.1 encoding of signature CVE-2016-1000343 — bouncycastle: DSA key pair generator generates a weak private key by default CVE-2016-1000344 — bouncycastle: DHIES implementation allowed the use of ECB mode CVE-2016-1000345 — bouncycastle: DHIES/ECIES CBC modes are vulnerable to padding oracle attack CVE-2016-1000346 — bouncycastle: Other party DH public keys are not fully validated CVE-2016-1000352 — bouncycastle: ECIES implementation allowed the use of ECB mode CVE-2017-5929 — logback: Serialization vulnerability in SocketServer and ServerSocketReceiver CVE-2017-7233 — python-django: Open redirect and possible XSS attack via user-supplied numeric redirect URLs CVE-2017-7536 — hibernate-validator: Privilege escalation when running under the security manager CVE-2017-10689 — puppet: Unpacking of tarballs in tar/mini.rb can create files with insecure permissions CVE-2017-10690 — puppet: Environment leakage in puppet-agent CVE-2017-12175 — 6: XSS in discovery rule filter autocomplete functionality CVE-2017-15095 — jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-7525) CVE-2017-15100 — foreman: Stored XSS in fact name or value CVE-2018-1090 — pulp: sensitive credentials revealed through the API CVE-2018-1096 — foreman: SQL injection due to improper handling of the widget id parameter CVE-2018-1097 — foreman: Ovirt admin password exposed by foreman API CVE-2018-5382 — bouncycastle: BKS-V1 keystore files vulnerable to trivial hash collisions CVE-2018-6188 — django: Information leakage in AuthenticationForm CVE-2018-7536 — django: Catastrophic backtracking in regular expressions via 'urlize' and 'urlizetrunc' CVE-2018-7537 — django: Catastrophic backtracking in regular expressions via 'truncatechars_html' and 'truncatewords_html' CVE-2018-10237 — guava: Unbounded memory allocation in AtomicDoubleArray and CompoundOrdering classes allow remote attackers to cause a denial of service

🎯 Affected products200

  • Red Hat Satellite 6.4
  • Red Hat Satellite Capsule 6.4
  • SOAPpy-0:0.11.6-17.el7.noarch as a component of Red Hat Satellite 6.4
  • SOAPpy-0:0.11.6-17.el7.noarch as a component of Red Hat Satellite Capsule 6.4
  • SOAPpy-0:0.11.6-17.el7.src as a component of Red Hat Satellite 6.4
  • SOAPpy-0:0.11.6-17.el7.src as a component of Red Hat Satellite Capsule 6.4
  • ansiblerole-insights-client-0:1.5-1.el7sat.noarch as a component of Red Hat Satellite 6.4
  • ansiblerole-insights-client-0:1.5-1.el7sat.noarch as a component of Red Hat Satellite Capsule 6.4
  • ansiblerole-insights-client-0:1.5-1.el7sat.src as a component of Red Hat Satellite 6.4
  • ansiblerole-insights-client-0:1.5-1.el7sat.src as a component of Red Hat Satellite Capsule 6.4
  • candlepin-0:2.4.8-1.el7.noarch as a component of Red Hat Satellite 6.4
  • candlepin-0:2.4.8-1.el7.src as a component of Red Hat Satellite 6.4
  • candlepin-selinux-0:2.4.8-1.el7.noarch as a component of Red Hat Satellite 6.4
  • createrepo_c-0:0.7.4-1.el7sat.src as a component of Red Hat Satellite 6.4
  • createrepo_c-0:0.7.4-1.el7sat.src as a component of Red Hat Satellite Capsule 6.4
  • createrepo_c-0:0.7.4-1.el7sat.x86_64 as a component of Red Hat Satellite 6.4
  • createrepo_c-0:0.7.4-1.el7sat.x86_64 as a component of Red Hat Satellite Capsule 6.4
  • createrepo_c-debuginfo-0:0.7.4-1.el7sat.x86_64 as a component of Red Hat Satellite 6.4
  • createrepo_c-debuginfo-0:0.7.4-1.el7sat.x86_64 as a component of Red Hat Satellite Capsule 6.4
  • createrepo_c-libs-0:0.7.4-1.el7sat.x86_64 as a component of Red Hat Satellite 6.4
  • createrepo_c-libs-0:0.7.4-1.el7sat.x86_64 as a component of Red Hat Satellite Capsule 6.4
  • foreman-0:1.18.0.37-1.el7sat.noarch as a component of Red Hat Satellite 6.4
  • foreman-0:1.18.0.37-1.el7sat.src as a component of Red Hat Satellite 6.4
  • foreman-0:1.18.0.37-1.el7sat.src as a component of Red Hat Satellite Capsule 6.4
  • foreman-bootloaders-redhat-0:201801241201-3.el7sat.noarch as a component of Red Hat Satellite 6.4
  • foreman-bootloaders-redhat-0:201801241201-3.el7sat.noarch as a component of Red Hat Satellite Capsule 6.4
  • foreman-bootloaders-redhat-0:201801241201-3.el7sat.src as a component of Red Hat Satellite 6.4
  • foreman-bootloaders-redhat-0:201801241201-3.el7sat.src as a component of Red Hat Satellite Capsule 6.4
  • foreman-bootloaders-redhat-tftpboot-0:201801241201-3.el7sat.noarch as a component of Red Hat Satellite 6.4
  • foreman-bootloaders-redhat-tftpboot-0:201801241201-3.el7sat.noarch as a component of Red Hat Satellite Capsule 6.4
  • +170 more not shown

✅ Remediation

For detailed instructions how to apply this update, refer to: https://access.redhat.com/documentation/en-us/red_hat_satellite/6.4/html/upgrading_and_updating_red_hat_satellite/ Workaround: Mitigation to this problem is to not trigger polymorphic desrialization globally by using: objectMapper.enableDefaultTyping() and rather use @JsonTypeInfo on the class property to explicitly define the type information. For more information on this issue please refer to https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true

🔗 References (117)