RHSA-2026:92861CriticalCVSS 8.8

Red Hat Security Advisory: Satellite 6.19 security update

Published
October 29, 2026
Last Modified
October 31, 2026

🔗 CVE IDs covered (47)

CVE-2026-78667 →CVE-2026-97031 →CVE-2026-110859 →CVE-2026-112398 →CVE-2026-112404 →CVE-2026-112405 →CVE-2026-112893 →CVE-2026-112895 →CVE-2026-15307 →CVE-2026-68497 →CVE-2026-78677 →CVE-2026-96778 →CVE-2026-112402 →CVE-2026-56853 →CVE-2026-96643 →CVE-2026-97689 →CVE-2026-112400 →CVE-2026-112403 →CVE-2026-112406 →CVE-2026-112897 →CVE-2026-114145 →CVE-2026-94440 →CVE-2026-96640 →CVE-2026-112894 →CVE-2026-59646 →CVE-2026-73619 →CVE-2026-84445 →CVE-2026-87819 →CVE-2026-97687 →CVE-2026-110857 →CVE-2026-112392 →CVE-2026-112391 →CVE-2026-112399 →CVE-2026-112892 →CVE-2026-112390 →CVE-2026-89425 →CVE-2026-18660 →CVE-2026-89407 →CVE-2026-110856 →CVE-2026-111943 →CVE-2026-19203 →CVE-2026-78669 →CVE-2026-110858 →CVE-2026-111497 →CVE-2026-112393 →CVE-2026-112397 →CVE-2026-112896 →

📋 Description

CVE-2026-15307 — django: Django: Remote code execution via GeoDjango spatial lookups CVE-2026-18660 — org.eclipse.jetty/jetty-server: org.eclipse.jetty/jetty-proxy: Eclipse Jetty: Access control bypass via case-sensitive host filtering CVE-2026-19203 — org.eclipse.jetty/jetty-http: Jetty: HTTP request smuggling via crafted chunked requests CVE-2026-56853 — net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service CVE-2026-59646 — org.bouncycastle/bc-java: org.bouncycastle/bctls-fips: Bouncy Castle for Java: Denial of Service via unchecked DTLS handshake reassembler buffer allocation CVE-2026-68497 — com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing CVE-2026-73619 — gitpython: GitPython: Arbitrary file read vulnerability via Repo.archive() CVE-2026-78667 — net/http: golang: golang: Denial of Service via crafted HTTP Range headers CVE-2026-78669 — net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames CVE-2026-78677 — GitPython: GitPython: Arbitrary Code Execution via Path Traversal CVE-2026-84445 — google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests CVE-2026-87819 — GitPython: GitPython: Denial of Service via crafted commit author field CVE-2026-89407 — com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking CVE-2026-89425 — com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing CVE-2026-94440 — net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing CVE-2026-96640 — pillow: pillow: Denial of Service via duplicate page references in PDF files CVE-2026-96643 — pillow: pillow: Denial of Service via repeated EXIF headers CVE-2026-96778 — pillow: pillow: Arbitrary code execution via JPEG encoder buffer overflow CVE-2026-97031 — crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references CVE-2026-97687 — urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override CVE-2026-97689 — urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser CVE-2026-110856 — GitPython: GitPython: Denial of Service via regular expression backtracking in date parsing CVE-2026-110857 — GitPython: GitPython: Arbitrary code execution via unsafe URL protocol handling CVE-2026-110858 — GitPython: GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() Refspec CVE-2026-110859 — GitPython: GitPython: Arbitrary file read via argument injection in branch checkout CVE-2026-111497 — brotli: Out-of-Bounds Write in Google Brotli Decoder CVE-2026-111943 — crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates CVE-2026-112390 — pillow: Pillow: Denial of Service via infinite loop during crafted MIC image parsing CVE-2026-112391 — pillow: Pillow: Denial of Service via unbounded recursion in PDF parser CVE-2026-112392 — pillow: pillow: Denial of Service via zero-size images in rank filters CVE-2026-112393 — pillow: Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO CVE-2026-112397 — pillow: pillow: Denial of Service via out-of-bounds memory access on zero-width images CVE-2026-112398 — pillow: Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution CVE-2026-112399 — pillow: pillow: Denial of service via crafted APNG image CVE-2026-112400 — pillow: pillow: Denial of Service via memory exhaustion from crafted GIF image CVE-2026-112402 — pillow: pillow: Denial of service via double free during image transformation CVE-2026-112403 — pillow: Pillow: Heap buffer overflow in ImagingJpegDecode CVE-2026-112404 — pillow: Pillow: Denial of Service via out-of-bounds read in TIFF decoding CVE-2026-112405 — pillow: Pillow: Denial of Service via null pointer dereference in Image.merge() CVE-2026-112406 — pillow: pillow: Denial of Service via infinite loop during PDF page rewriting CVE-2026-112892 — pillow: pillow: Denial of Service via unbounded memory expansion in MSP image decoder CVE-2026-112893 — pillow: Pillow: Denial of Service via invalid pointer free during font rendering CVE-2026-112894 — pillow: pillow: Denial of Service via crafted multi-frame image conversion CVE-2026-112895 — pillow: pillow: Denial of service via crafted PDF during append operations CVE-2026-112896 — pillow: Pillow: Denial of Service via out-of-bounds read in TIFF encoder CVE-2026-112897 — pillow: pillow: Information disclosure via uninitialized buffer in TIFF decoding CVE-2026-114145 — GitPython: GitPython: arbitrary code execution via improper submodule path validation

🎯 Affected products23

  • Red Hat Satellite 6.19 for RHEL 9
  • openvox-agent-0:8.31.1-1.el9sat.src as a component of Red Hat Satellite 6.19 for RHEL 9
  • openvox-agent-0:8.31.1-1.el9sat.x86_64 as a component of Red Hat Satellite 6.19 for RHEL 9
  • openvox-server-0:8.17.0-1.el9sat.noarch as a component of Red Hat Satellite 6.19 for RHEL 9
  • openvox-server-0:8.17.0-1.el9sat.src as a component of Red Hat Satellite 6.19 for RHEL 9
  • python3.12-brotli-0:1.2.1-1.el9pc.src as a component of Red Hat Satellite 6.19 for RHEL 9
  • python3.12-brotli-0:1.2.1-1.el9pc.x86_64 as a component of Red Hat Satellite 6.19 for RHEL 9
  • python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64 as a component of Red Hat Satellite 6.19 for RHEL 9
  • python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64 as a component of Red Hat Satellite 6.19 for RHEL 9
  • python3.12-django-0:4.2.30-3.el9pc.noarch as a component of Red Hat Satellite 6.19 for RHEL 9
  • python3.12-django-0:4.2.30-3.el9pc.src as a component of Red Hat Satellite 6.19 for RHEL 9
  • python3.12-gitpython-0:3.2.1-1.el9pc.noarch as a component of Red Hat Satellite 6.19 for RHEL 9
  • python3.12-gitpython-0:3.2.1-1.el9pc.src as a component of Red Hat Satellite 6.19 for RHEL 9
  • python3.12-pillow-0:13.0.0-1.el9pc.src as a component of Red Hat Satellite 6.19 for RHEL 9
  • python3.12-pillow-0:13.0.0-1.el9pc.x86_64 as a component of Red Hat Satellite 6.19 for RHEL 9
  • python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64 as a component of Red Hat Satellite 6.19 for RHEL 9
  • python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64 as a component of Red Hat Satellite 6.19 for RHEL 9
  • python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch as a component of Red Hat Satellite 6.19 for RHEL 9
  • python3.12-pulp-ansible-1:0.28.10-1.el9pc.src as a component of Red Hat Satellite 6.19 for RHEL 9
  • python3.12-urllib3-0:2.8.0-1.el9pc.noarch as a component of Red Hat Satellite 6.19 for RHEL 9
  • python3.12-urllib3-0:2.8.0-1.el9pc.src as a component of Red Hat Satellite 6.19 for RHEL 9
  • yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src as a component of Red Hat Satellite 6.19 for RHEL 9
  • yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64 as a component of Red Hat Satellite 6.19 for RHEL 9

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For detailed instructions on applying this update, refer to: https://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/updating_red_hat_satellite/index Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: There is no mitigation for this issue other than applying the fix. As a temporary workaround, administrators who rely on Jetty host allow/deny filtering should add case-variant duplicates of every configured hostname to the filter lists, or enforce hostname case-normalization at an upstream load balancer or reverse proxy, until the update is installed. Workaround: Upgrade jackson-databind to 2.18.10, 2.21.6, 2.22.2, or later fixed releases as applicable. Until updated, restrict untrusted JSON input size and complexity. Workaround: In case you consume HTTP2, upgrade to a patched version of the http module. Verify: ``` go version go list -m golang.org/x/net govulncheck ./... ``` Workaround: To mitigate this vulnerability, upgrade to GitPython version 3.1.59 or later, which correctly includes `--separate-git-dir` in the unsafe options denylist. If upgrading is not immediately possible, ensure that the `separate_git_dir` parameter is never populated from untrusted or user-controlled sources. Applications should validate and sanitize any input before passing it to GitPython cloning methods, or avoid exposing the `separate_git_dir` parameter to external callers entirely. Workaround: Update GitPython to version 3.1.60 or later. Validate and sanitize git repository sources before processing. Enable git fsck validation (receive.fsckObjects) on git servers to reject malformed commit objects. Implement length limits on commit metadata fields before processing. Workaround: See the security bulletin for a detailed mitigation procedure. Workaround: --- CME Mitigation Guidance (2026-10-20) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to prevent Pillow from enumerating or extracting frames from untrusted Microsoft Image Composer (MIC) files when olefile is installed: upgrade to Pillow 13.0.0 (or the fixed Python Pillow/Python3.11 Pillow/Rhoai/Odh Openvino Model Server Rhel/Rhelai3/Bootc Cuda Rhel/Rhelai3/Bootc Gaudi Rhel/Rhelai3/Bootc Rocm Rhel/Rhelai3/Disk Image Cuda Rhel/Python3X Pillow/Rhaiis/Vllm Spyre Rhel/Rhoai/Odh Kserve Storage Initializer Rhel/Rhoai/Odh Kserve Agent Rhel/Rhoai/Odh Kserve Controller Rhel/Rhoai/Odh Kserve Router Rhel/Rhoai/Odh Feature Server Rhel/Rhoai/Odh Trustyai Nemo Guardrails Server Rhel/Rhaiis/Vllm Tpu Rhel/Rhoai/Odh Training Cuda128 Torch29 Py312 Rhel/Rhoai/Odh Training Rocm64 Torch29 Py312 Rhel/Rhaiis/Vllm Cpu Rhel/Rhaiis/Vllm Neuron Rhel/Ansible Automation Platform 25/Lightspeed Chatbot Rhel/Openshift Lightspeed/Lightspeed Ocp Rag Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Vllm Gaudi Rhel/Python3.12 Pillow/Rhaii/Vllm Gaudi Rhel/Rhaii/Vllm Neuron Rhel/Rhaii/Vllm Tpu Rhel/Lightspeed Core/Lightspeed Stack Rhel/Rhoai/Odh Kserve Autogluon Server Rhel/Rhai Early Access/Docling Sdk Cuda Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhoai/Odh Llm D Kv Cache Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Llmcompressor Cuda Py312 Rhel/Ask Sre/Rhel Cla/Rlsapi Rhel/Rhaiis/Model Opt Cuda Rhel/Rhaiis/Vllm Cuda Rhel/Rhaiis/Vllm Rocm Rhel/Rhaii/Model Opt Cuda Rhel/Rhaii/Vllm Cpu Rhel/Rhaii/Vllm Cuda Rhel/Rhaii/Vllm Rocm Rhel/Rhaii/Vllm Spyre Rhel/Ansible Automation Platform/Automation Dashboard Rhel/Ansible Automation Platform 26/Hub Rhel/Ansible Automation Platform 26/Lightspeed Chatbot Rhel/Ansible Automation Platform 27/Hub Rhel/Ansible Automation Platform 27/Lightspeed Chatbot Rhel/Galaxy Ng/Automation Hub Container/Aap Rag Content/Ansible Chatbot Stack/Koku Report Emailer/Exploit Intelligence/Vulnerability Analysis Rhel/Insights Host Inventory/Google Lightspeed Agent/Lscore Deploy/Lightspeed Core/Rag Tool Cpu Rhel/Lightspeed Core/Rag Tool Cuda 12.9 Rhel/Lightspeed Services Ocp/Ocp Rules Rhel/Openshift Lightspeed Tech Preview/Lightspeed Rag Tool Rhel/Openshift Lightspeed/Lightspeed Service Api Rhel/Rhoai/Odh Caikit Tgis Serving Rhel/Rhoai/Odh Llama Stack Core Rhel/Rhoai/Odh Pipeline Runtime Pytorch Llmcompressor Cuda Py312 Rhel/Rhoai/Odh Automl Rhel/Rhoai/Odh Autorag Rhel/Rhoai/Odh Mlflow Rhel/Rhoai/Odh Pipeline Runtime Datascience Cpu Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Rocm Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Rocm Py312 Rhel/Rhoai/Odh Trustyai Garak Lls Provider Dsp Rhel/Rhoai/Odh Workbench Codeserver Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Trustyai Cpu Py312 Rhel/Rhai/Guidellm Rhel/Rhoai/Odh Ogx Core Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Rocm Py312 Rhel/Quay/Quay Service Tool/Quay/Quay Rhel/Rhelai3/Bootc Aws Cuda Rhel/Rhelai3/Bootc Azure Cuda Rhel/Rhelai3/Bootc Azure Rocm Rhel/Rhelai3/Bootc Gcp Cuda Rhel builds), which initialize _n_frames in __init__ instead of resetting it in _open(), and avoid re-setting _n_frames and is_animated in _seek() if already set, closing crafted Microsoft Image Composer (MIC) file with an embedded TIFF containing three or more IFDs. Until patched, this is a concern on Applications running Pillow 7.2.0 through 12.3.0 with olefile installed that query n_frames or extract frames from untrusted input, so Reject or sanitize untrusted MIC file uploads at ingestion and avoid calling n_frames or save_all on unverified images in environments where olefile is loaded. As a compensating measure, Impose CPU time limits using ulimit or prlimit to terminate worker processes caught in the non-advancing MIC image parsing loop before system CPU is exhausted and Configure service watchdogs with automatic restart under systemd to detect stalled processes via keep-alives and restore availability. These controls limit blast radius and contain exploitation, but they do not fix the underlying non-advancing frame traversal defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-114 Process Resource Limits (ulimit/prlimit) (medium) Workaround: --- CME Mitigation Guidance (2026-10-20) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to enforce recursion depth limits in PdfParser when reading nested PDF data structures during append operations: upgrade to Pillow 13.0.0 (or the fixed Python Pillow/Python3.11 Pillow/Rhoai/Odh Openvino Model Server Rhel/Rhelai3/Bootc Cuda Rhel/Rhelai3/Bootc Gaudi Rhel/Rhelai3/Bootc Rocm Rhel/Rhelai3/Disk Image Cuda Rhel/Python3X Pillow/Rhaiis/Vllm Spyre Rhel/Rhoai/Odh Kserve Stora…

🔗 References (3)