RHSA-2023:2097HighCVSS 9.8

Red Hat Security Advisory: Satellite 6.13 Release

Published
May 3, 2023
Last Modified
August 6, 2026

🔗 CVE IDs covered (26)

CVE-2022-31163 →CVE-2022-33980 →CVE-2022-38751 →CVE-2022-41946 →CVE-2022-42003 →CVE-2022-42889 →CVE-2021-46877 →CVE-2022-1471 →CVE-2022-23515 →CVE-2022-25857 →CVE-2022-32224 →CVE-2022-38749 →CVE-2022-38750 →CVE-2022-41323 →CVE-2022-22577 →CVE-2022-23514 →CVE-2022-23516 →CVE-2022-23518 →CVE-2022-23519 →CVE-2022-23520 →CVE-2022-27777 →CVE-2022-38752 →CVE-2022-23517 →CVE-2022-42004 →CVE-2023-23969 →CVE-2023-24580 →

📋 Description

CVE-2021-46877 — jackson-databind: Possible DoS if using JDK serialization to serialize JsonNode CVE-2022-1471 — SnakeYaml: Constructor Deserialization Remote Code Execution CVE-2022-22577 — rubygem-actionpack: Possible cross-site scripting vulnerability in Action Pack CVE-2022-23514 — rubygem-loofah: inefficient regular expression leading to denial of service CVE-2022-23515 — rubygem-loofah: Improper neutralization of data URIs leading to Cross Site Scripting CVE-2022-23516 — rubygem-loofah: Uncontrolled Recursion leading to denial of service CVE-2022-23517 — rubygem-rails-html-sanitizer: Inefficient Regular Expression leading to denial of service CVE-2022-23518 — rubygem-rails-html-sanitizer: Improper neutralization of data URIs leading to Cross site scripting CVE-2022-23519 — rubygem-rails-html-sanitizer: Cross site scripting vulnerability with certain configurations CVE-2022-23520 — rubygem-rails-html-sanitizer: Cross site scripting vulnerability with certain configurations CVE-2022-25857 — snakeyaml: Denial of Service due to missing nested depth limitation for collections CVE-2022-27777 — tfm-rubygem-actionview: Possible cross-site scripting vulnerability in Action View tag helpers CVE-2022-31163 — rubygem-tzinfo: arbitrary code execution CVE-2022-32224 — activerecord: Possible RCE escalation bug with Serialized Columns in Active Record CVE-2022-33980 — apache-commons-configuration: Apache Commons Configuration insecure interpolation defaults CVE-2022-38749 — snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode CVE-2022-38750 — snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject CVE-2022-38751 — snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match CVE-2022-38752 — snakeyaml: Uncaught exception in java.base/java.util.ArrayList.hashCode CVE-2022-41323 — python-django: Potential denial-of-service vulnerability in internationalized URLs CVE-2022-41946 — postgresql-jdbc: Information leak of prepared statement data due to insecure temporary file permissions CVE-2022-42003 — jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS CVE-2022-42004 — jackson-databind: use of deeply nested arrays CVE-2022-42889 — apache-commons-text: variable interpolation RCE CVE-2023-23969 — python-django: Potential denial-of-service via Accept-Language headers CVE-2023-24580 — python-django: Potential denial-of-service vulnerability in file uploads

🎯 Affected products200

  • Red Hat Satellite 6.13 for RHEL 8
  • ansible-collection-redhat-satellite-0:3.9.0-2.el8sat.noarch as a component of Red Hat Satellite 6.13 for RHEL 8
  • ansible-collection-redhat-satellite-0:3.9.0-2.el8sat.src as a component of Red Hat Satellite 6.13 for RHEL 8
  • ansible-collection-redhat-satellite_operations-0:1.3.0-2.el8sat.noarch as a component of Red Hat Satellite 6.13 for RHEL 8
  • ansible-collection-redhat-satellite_operations-0:1.3.0-2.el8sat.src as a component of Red Hat Satellite 6.13 for RHEL 8
  • ansible-lint-0:5.0.8-4.el8pc.noarch as a component of Red Hat Satellite 6.13 for RHEL 8
  • ansible-lint-0:5.0.8-4.el8pc.src as a component of Red Hat Satellite 6.13 for RHEL 8
  • ansible-runner-0:2.2.1-3.el8sat.noarch as a component of Red Hat Satellite 6.13 for RHEL 8
  • ansible-runner-0:2.2.1-3.el8sat.src as a component of Red Hat Satellite 6.13 for RHEL 8
  • ansiblerole-foreman_scap_client-0:0.2.0-2.el8sat.noarch as a component of Red Hat Satellite 6.13 for RHEL 8
  • ansiblerole-foreman_scap_client-0:0.2.0-2.el8sat.src as a component of Red Hat Satellite 6.13 for RHEL 8
  • ansiblerole-insights-client-0:1.7.1-2.el8sat.noarch as a component of Red Hat Satellite 6.13 for RHEL 8
  • ansiblerole-insights-client-0:1.7.1-2.el8sat.src as a component of Red Hat Satellite 6.13 for RHEL 8
  • candlepin-0:4.2.13-1.el8sat.noarch as a component of Red Hat Satellite 6.13 for RHEL 8
  • candlepin-0:4.2.13-1.el8sat.src as a component of Red Hat Satellite 6.13 for RHEL 8
  • candlepin-selinux-0:4.2.13-1.el8sat.noarch as a component of Red Hat Satellite 6.13 for RHEL 8
  • cjson-0:1.7.14-5.el8sat.src as a component of Red Hat Satellite 6.13 for RHEL 8
  • cjson-0:1.7.14-5.el8sat.x86_64 as a component of Red Hat Satellite 6.13 for RHEL 8
  • cjson-debuginfo-0:1.7.14-5.el8sat.x86_64 as a component of Red Hat Satellite 6.13 for RHEL 8
  • cjson-debugsource-0:1.7.14-5.el8sat.x86_64 as a component of Red Hat Satellite 6.13 for RHEL 8
  • createrepo_c-0:0.20.1-1.el8pc.src as a component of Red Hat Satellite 6.13 for RHEL 8
  • createrepo_c-0:0.20.1-1.el8pc.x86_64 as a component of Red Hat Satellite 6.13 for RHEL 8
  • createrepo_c-debuginfo-0:0.20.1-1.el8pc.x86_64 as a component of Red Hat Satellite 6.13 for RHEL 8
  • createrepo_c-debugsource-0:0.20.1-1.el8pc.x86_64 as a component of Red Hat Satellite 6.13 for RHEL 8
  • createrepo_c-libs-0:0.20.1-1.el8pc.x86_64 as a component of Red Hat Satellite 6.13 for RHEL 8
  • createrepo_c-libs-debuginfo-0:0.20.1-1.el8pc.x86_64 as a component of Red Hat Satellite 6.13 for RHEL 8
  • dynflow-utils-0:1.6.3-1.el8sat.src as a component of Red Hat Satellite 6.13 for RHEL 8
  • dynflow-utils-0:1.6.3-1.el8sat.x86_64 as a component of Red Hat Satellite 6.13 for RHEL 8
  • foreman-0:3.5.1.14-1.el8sat.noarch as a component of Red Hat Satellite 6.13 for RHEL 8
  • foreman-0:3.5.1.14-1.el8sat.src as a component of Red Hat Satellite 6.13 for RHEL 8
  • +170 more not shown

✅ Remediation

For Red Hat Satellite 6.13, see the following documentation for the release. https://access.redhat.com/documentation/en-us/red_hat_satellite/6.13 The important instructions on how to upgrade are available below. https://access.redhat.com/documentation/en-us/red_hat_satellite/6.13/html/upgrading_and_updating_red_hat_satellite Workaround: As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: This flaw may be avoided by ensuring that any external inputs used with the Commons-Text lookup methods are sanitized properly. Untrusted input should always be thoroughly sanitized before using in any potentially risky situations.

🔗 References (265)