RHSA-2026:50222HighCVSS 7.5

Red Hat Security Advisory: Satellite 6.17.10 Async Update

Published
August 4, 2026
Last Modified
August 20, 2026

🔗 CVE IDs covered (10)

CVE-2026-55379 →CVE-2026-55380 →CVE-2025-9230 →CVE-2026-2332 →CVE-2026-12515 →CVE-2026-54059 →CVE-2026-54060 →CVE-2026-57236 →CVE-2026-48526 →CVE-2026-54297 →

📋 Description

CVE-2025-9230 — openssl: Out-of-bounds read & write in RFC 3211 KEK Unwrap CVE-2026-2332 — org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing CVE-2026-12515 — katello: missing repository authorization in content_uploads exposes cross-product content existence CVE-2026-48526 — python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens CVE-2026-54059 — python-pillow: Pillow: Denial of Service via crafted PCF font data CVE-2026-54060 — python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files CVE-2026-54297 — faraday: Faraday: Denial of Service via crafted nested query strings CVE-2026-55379 — python-pillow: Pillow: Denial of Service via crafted BDF font file CVE-2026-55380 — python-pillow: Pillow: Denial of Service via crafted GD 2.x image file CVE-2026-57236 — nokogiri: Nokogiri: Denial of Service or Information Disclosure via invalid encoding handling

🎯 Affected products39

  • Red Hat Satellite 6.17 for RHEL 9
  • foreman-installer-1:3.14.0.11-1.el9sat.noarch as a component of Red Hat Satellite 6.17 for RHEL 9
  • foreman-installer-1:3.14.0.11-1.el9sat.src as a component of Red Hat Satellite 6.17 for RHEL 9
  • foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch as a component of Red Hat Satellite 6.17 for RHEL 9
  • openvox-agent-0:8.24.1-3.el9sat.src as a component of Red Hat Satellite 6.17 for RHEL 9
  • openvox-agent-0:8.24.1-3.el9sat.x86_64 as a component of Red Hat Satellite 6.17 for RHEL 9
  • openvox-server-0:8.14.1-1.el9sat.noarch as a component of Red Hat Satellite 6.17 for RHEL 9
  • openvox-server-0:8.14.1-1.el9sat.src as a component of Red Hat Satellite 6.17 for RHEL 9
  • python-pillow-0:12.3.0-1.el9pc.src as a component of Red Hat Satellite 6.17 for RHEL 9
  • python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 as a component of Red Hat Satellite 6.17 for RHEL 9
  • python-pulp-container-0:2.22.10-1.el9pc.src as a component of Red Hat Satellite 6.17 for RHEL 9
  • python-pyjwt-0:2.13.0-1.el9pc.src as a component of Red Hat Satellite 6.17 for RHEL 9
  • python-pysequoia-0:0.1.33-1.el9pc.src as a component of Red Hat Satellite 6.17 for RHEL 9
  • python3.11-pillow-0:12.3.0-1.el9pc.x86_64 as a component of Red Hat Satellite 6.17 for RHEL 9
  • python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 as a component of Red Hat Satellite 6.17 for RHEL 9
  • python3.11-pulp-container-0:2.22.10-1.el9pc.noarch as a component of Red Hat Satellite 6.17 for RHEL 9
  • python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch as a component of Red Hat Satellite 6.17 for RHEL 9
  • python3.11-pyjwt-0:2.13.0-1.el9pc.noarch as a component of Red Hat Satellite 6.17 for RHEL 9
  • python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64 as a component of Red Hat Satellite 6.17 for RHEL 9
  • rubygem-faraday-0:1.10.6-1.el9sat.noarch as a component of Red Hat Satellite 6.17 for RHEL 9
  • rubygem-faraday-0:1.10.6-1.el9sat.src as a component of Red Hat Satellite 6.17 for RHEL 9
  • rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch as a component of Red Hat Satellite 6.17 for RHEL 9
  • rubygem-foreman_maintain-1:1.10.6-1.el9sat.src as a component of Red Hat Satellite 6.17 for RHEL 9
  • rubygem-foreman_openscap-0:10.2.2-1.el9sat.noarch as a component of Red Hat Satellite 6.17 for RHEL 9
  • rubygem-foreman_openscap-0:10.2.2-1.el9sat.src as a component of Red Hat Satellite 6.17 for RHEL 9
  • rubygem-katello-0:4.16.0.18-1.el9sat.noarch as a component of Red Hat Satellite 6.17 for RHEL 9
  • rubygem-katello-0:4.16.0.18-1.el9sat.src as a component of Red Hat Satellite 6.17 for RHEL 9
  • rubygem-nokogiri-0:1.15.7-3.el9sat.src as a component of Red Hat Satellite 6.17 for RHEL 9
  • rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 as a component of Red Hat Satellite 6.17 for RHEL 9
  • rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 as a component of Red Hat Satellite 6.17 for RHEL 9
  • +9 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For detailed instructions how to apply this update, refer to: https://docs.redhat.com/en/documentation/red_hat_satellite/6.17/html/updating_red_hat_satellite/index Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates if they become available. Workaround: Do not load PCF fonts from untrusted sources. If PCF font loading is required, validate font file dimensions before passing them to Pillow, or upgrade to Pillow 12.3.0 or later which includes the fix for this vulnerability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Do not load BDF font files from untrusted sources. Applications that only process standard image formats (PNG, JPEG, etc.) and do not use BdfFontFile or ImageFont.load() with BDF files are not affected. Workaround: Avoid processing untrusted GD 2.x image files with PIL.GdImageFile.open(). Use Image.open() instead, which includes decompression bomb protections for supported formats. If GdImageFile must be used, validate the image dimensions before calling load(). Restricting accepted image formats at the application boundary to only those explicitly needed can reduce exposure.

🔗 References (18)