RHSA-2020:4366HighCVSS 8.8

Red Hat Security Advisory: Satellite 6.8 release

Published
October 27, 2020
Last Modified
August 4, 2026

🔗 CVE IDs covered (28)

CVE-2020-9546 →CVE-2020-14334 →CVE-2020-14380 →CVE-2019-16782 →CVE-2020-7663 →CVE-2020-7942 →CVE-2020-8184 →CVE-2020-10693 →CVE-2020-10968 →CVE-2020-10969 →CVE-2020-14061 →CVE-2018-3258 →CVE-2018-1000119 →CVE-2019-10219 →CVE-2020-5267 →CVE-2020-7238 →CVE-2020-7943 →CVE-2020-9547 →CVE-2020-9548 →CVE-2018-11751 →CVE-2019-12781 →CVE-2020-5217 →CVE-2020-8161 →CVE-2020-8840 →CVE-2020-11619 →CVE-2020-14062 →CVE-2020-14195 →CVE-2020-5216 →

📋 Description

CVE-2018-3258 — mysql-connector-java: Connector/J unspecified vulnerability (CPU October 2018) CVE-2018-11751 — puppet-agent: Puppet Agent does not properly verify SSL connection when downloading a CRL CVE-2018-1000119 — rack-protection: Timing attack in authenticity_token.rb CVE-2019-10219 — hibernate-validator: safeHTML validator allows XSS CVE-2019-12781 — Django: Incorrect HTTP detection with reverse-proxy connecting via HTTPS CVE-2019-16782 — rubygem-rack: hijack sessions by using timing attacks targeting the session id CVE-2020-5216 — rubygem-secure_headers: limited header injection when using dynamic overrides with user input CVE-2020-5217 — rubygem-secure_headers: directive injection when using dynamic overrides with user input CVE-2020-5267 — rubygem-actionview: views that use the j or escape_javascript methods are susceptible to XSS attacks CVE-2020-7238 — netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling CVE-2020-7663 — rubygem-websocket-extensions: ReDoS vulnerability in Sec-WebSocket-Extensions parser CVE-2020-7942 — puppet: Arbitrary catalog retrieval CVE-2020-7943 — puppet: puppet server and puppetDB may leak sensitive information via metrics API CVE-2020-8161 — rubygem-rack: directory traversal in Rack::Directory CVE-2020-8184 — rubygem-rack: percent-encoded cookies can be used to overwrite existing prefixed cookie names CVE-2020-8840 — jackson-databind: Lacks certain xbean-reflect/JNDI blocking CVE-2020-9546 — jackson-databind: Serialization gadgets in shaded-hikari-config CVE-2020-9547 — jackson-databind: Serialization gadgets in ibatis-sqlmap CVE-2020-9548 — jackson-databind: Serialization gadgets in anteros-core CVE-2020-10693 — hibernate-validator: Improper input validation in the interpolation of constraint error messages CVE-2020-10968 — jackson-databind: Serialization gadgets in org.aoju.bus.proxy.provider.*.RmiProvider CVE-2020-10969 — jackson-databind: Serialization gadgets in javax.swing.JEditorPane CVE-2020-11619 — jackson-databind: Serialization gadgets in org.springframework:spring-aop CVE-2020-14061 — jackson-databind: serialization in weblogic/oracle-aqjms CVE-2020-14062 — jackson-databind: serialization in com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool CVE-2020-14195 — jackson-databind: serialization in org.jsecurity.realm.jndi.JndiRealmFactory CVE-2020-14334 — foreman: unauthorized cache read on RPM-based installations through local user CVE-2020-14380 — Satellite: Local user impersonation by Single sign-on (SSO) user leads to account takeover

🎯 Affected products200

  • Red Hat Satellite 6.8
  • Red Hat Satellite Capsule 6.8
  • ansible-collection-redhat-satellite-0:1.3.0-1.el7sat.noarch as a component of Red Hat Satellite 6.8
  • ansible-collection-redhat-satellite-0:1.3.0-1.el7sat.noarch as a component of Red Hat Satellite Capsule 6.8
  • ansible-collection-redhat-satellite-0:1.3.0-1.el7sat.src as a component of Red Hat Satellite 6.8
  • ansible-collection-redhat-satellite-0:1.3.0-1.el7sat.src as a component of Red Hat Satellite Capsule 6.8
  • ansible-runner-0:1.4.6-1.el7ar.noarch as a component of Red Hat Satellite 6.8
  • ansible-runner-0:1.4.6-1.el7ar.noarch as a component of Red Hat Satellite Capsule 6.8
  • ansible-runner-0:1.4.6-1.el7ar.src as a component of Red Hat Satellite 6.8
  • ansible-runner-0:1.4.6-1.el7ar.src as a component of Red Hat Satellite Capsule 6.8
  • ansiblerole-foreman_scap_client-0:0.0.5-1.el7sat.noarch as a component of Red Hat Satellite 6.8
  • ansiblerole-foreman_scap_client-0:0.0.5-1.el7sat.noarch as a component of Red Hat Satellite Capsule 6.8
  • ansiblerole-foreman_scap_client-0:0.0.5-1.el7sat.src as a component of Red Hat Satellite 6.8
  • ansiblerole-foreman_scap_client-0:0.0.5-1.el7sat.src as a component of Red Hat Satellite Capsule 6.8
  • ansiblerole-insights-client-0:1.7.1-1.el7sat.noarch as a component of Red Hat Satellite 6.8
  • ansiblerole-insights-client-0:1.7.1-1.el7sat.noarch as a component of Red Hat Satellite Capsule 6.8
  • ansiblerole-insights-client-0:1.7.1-1.el7sat.src as a component of Red Hat Satellite 6.8
  • ansiblerole-insights-client-0:1.7.1-1.el7sat.src as a component of Red Hat Satellite Capsule 6.8
  • ansiblerole-satellite-receptor-installer-0:0.6.13-1.el7sat.noarch as a component of Red Hat Satellite 6.8
  • ansiblerole-satellite-receptor-installer-0:0.6.13-1.el7sat.noarch as a component of Red Hat Satellite Capsule 6.8
  • ansiblerole-satellite-receptor-installer-0:0.6.13-1.el7sat.src as a component of Red Hat Satellite 6.8
  • ansiblerole-satellite-receptor-installer-0:0.6.13-1.el7sat.src as a component of Red Hat Satellite Capsule 6.8
  • candlepin-0:3.1.21-1.el7sat.noarch as a component of Red Hat Satellite 6.8
  • candlepin-0:3.1.21-1.el7sat.src as a component of Red Hat Satellite 6.8
  • candlepin-selinux-0:3.1.21-1.el7sat.noarch as a component of Red Hat Satellite 6.8
  • crane-selinux-0:3.4.0-1.el7sat.noarch as a component of Red Hat Satellite 6.8
  • crane-selinux-0:3.4.0-1.el7sat.noarch as a component of Red Hat Satellite Capsule 6.8
  • createrepo_c-0:0.7.4-1.el7sat.src as a component of Red Hat Satellite 6.8
  • createrepo_c-0:0.7.4-1.el7sat.src as a component of Red Hat Satellite Capsule 6.8
  • createrepo_c-0:0.7.4-1.el7sat.x86_64 as a component of Red Hat Satellite 6.8
  • +170 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: There is no mitigation for this issue, the flaw can only be resolved by applying updates. Workaround: * Use HTTP/2 instead (clear boundaries between requests) * Disable reuse of backend connections eg. ```http-reuse never``` in HAProxy or whatever equivalent LB settings Workaround: In the puppet.conf configuration file set `strict_hostname_checking = true`. Workaround: Disable the trapperkeeper-metrics /v1 metrics API Workaround: You can pass user input as an expression variable by unwrapping the context to HibernateConstraintValidatorContext. Please refer to the https://in.relation.to/2020/05/07/hibernate-validator-615-6020-released/ and https://docs.jboss.org/hibernate/stable/validator/reference/en-US/html_single/#_the_code_constraintvalidatorcontext_code. Workaround: The following conditions are needed for an exploit, we recommend avoiding all if possible * Deserialization from sources you do not control * `enableDefaultTyping()` * `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS` Workaround: The following conditions are needed for an exploit, we recommend avoiding all if possible: * Deserialization from sources you do not control * `enableDefaultTyping()` * `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS` Workaround: The following conditions are needed for an exploit, we recommend avoiding all if possible: * Deserialization from sources you do not control * enableDefaultTyping() * @JsonTypeInfo using id.CLASS or id.MINIMAL_CLASS * oracle.jms.AQjms*ConnectionFactory in classpath Workaround: The following conditions are needed for an exploit, we recommend avoiding all if possible: * Deserialization from sources you do not control * enableDefaultTyping() * @JsonTypeInfo using id.CLASS or id.MINIMAL_CLASS * com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool in classpath Workaround: The following conditions are needed for an exploit, we recommend avoiding all if possible: * Deserialization from sources you do not control * enableDefaultTyping() * @JsonTypeInfo using id.CLASS or id.MINIMAL_CLASS * org.jsecurity.realm.jndi.JndiRealmFactory in classpath Workaround: This flaw can be mitigated by manually changing the directory permissions to remove readable bits for the others: # chmod 0750 /run/foreman Workaround: This issue can be mitigated by disabling the external login if a Satellite user has their authentication set to INTERNAL.

🔗 References (486)