Lucene search

RedHatRHSA-2024:2010

HistoryApr 23, 2024 - 5:00 p.m.

(RHSA-2024:2010) Important: Satellite 6.15.0 release

2024-04-2317:00:52

access.redhat.com

redos

side-channel leakage

arithmetic overflow

insecure tarfile extraction

http request smuggling

potential denial of service

crlf injection

directory traversal vulnerability

7.6 High

AI Score

Confidence

Low

0.052 Low

EPSS

Percentile

93.0%

JSON

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s)
listed in the References section.

Security fixes:

python-pygments: ReDoS in pygments (CVE-2022-40896)
python-pycryptodomex: Side-channel leakage for OAEP decryption in PyCryptodome and pycryptodomex (CVE-2023-52323)
satellite: Arithmetic overflow in satellite (CVE-2023-4320)
automation-hub: Ansible Automation Hub: insecure galaxy-importer tarfile extraction (CVE-2023-5189)
jetty: Improper addition of quotation marks to user inputs in CgiServlet (CVE-2023-36479)
python-aiohttp: HTTP request smuggling via llhttp HTTP request parser (CVE-2023-37276)
rubygem-activesupport: File Disclosure of Locally Encrypted Files (CVE-2023-38037)
jetty: Improper validation of HTTP/1 content-length (CVE-2023-40167)
python-django: Potential denial of service vulnerability in django.utils.encoding.uri_to_iri() (CVE-2023-41164)
python-django: Denial-of-service possibility in django.utils.text.Truncator (CVE-2023-43665)
python-aiohttp: Numerous issues in HTTP parser with header parsing (CVE-2023-47627)
python-aiohttp: HTTP request modification (CVE-2023-49081)
python-aiohttp: CRLF injection if user controls the HTTP method using aiohttp client (CVE-2023-49082)
rubygem-puma: HTTP request smuggling when parsing chunked Transfer-Encoding Bodies (CVE-2024-21647)
rubygem-audited: Race condition can lead to audit logs being incorrectly attributed to the wrong user (CVE-2024-22047)
python-jinja2: HTML attribute injection when passing user input as keys to xmlattr filter (CVE-2024-22195)
python-aiohttp: Follow_symlinks directory traversal vulnerability (CVE-2024-23334)
python-aiohttp: HTTP request smuggling (CVE-2024-23829)

Additional Changes:
This update also fixes several bugs and adds various enhancements.

Documentation for these changes is available from the Release Notes document linked to in the References section.

OSVersionArchitecturePackageVersionFilename
RedHat8x86_64python-brotli-debugsource< 1.0.9-4.el8pcpython-brotli-debugsource-1.0.9-4.el8pc.x86_64.rpm
RedHat8noarchcandlepin< 4.3.12-1.el8satcandlepin-4.3.12-1.el8sat.noarch.rpm
RedHat8noarchpython3.11-opentelemetry_exporter_otlp_proto_http< 1.19.0-5.el8pcpython3.11-opentelemetry_exporter_otlp_proto_http-1.19.0-5.el8pc.noarch.rpm
RedHat8noarchrubygem-smart_proxy_dynflow< 0.9.1-1.el8satrubygem-smart_proxy_dynflow-0.9.1-1.el8sat.noarch.rpm
RedHat8x86_64cjson-debugsource< 1.7.14-5.el8satcjson-debugsource-1.7.14-5.el8sat.x86_64.rpm
RedHat8noarchrubygem-crass< 1.0.6-2.el8satrubygem-crass-1.0.6-2.el8sat.noarch.rpm
RedHat8noarchpython3.11-attrs< 21.4.0-5.el8pcpython3.11-attrs-21.4.0-5.el8pc.noarch.rpm
RedHat8noarchrubygem-deep_cloneable< 3.2.0-1.el8satrubygem-deep_cloneable-3.2.0-1.el8sat.noarch.rpm
RedHat8noarchrubygem-mime-types-data< 3.2023.1003-1.el8satrubygem-mime-types-data-3.2023.1003-1.el8sat.noarch.rpm
RedHat8noarchpython3.11-pexpect< 4.8.0-5.el8pcpython3.11-pexpect-4.8.0-5.el8pc.noarch.rpm

OS	Version	Architecture	Package	Version	Filename
RedHat	8	x86_64	python-brotli-debugsource	< 1.0.9-4.el8pc	python-brotli-debugsource-1.0.9-4.el8pc.x86_64.rpm
RedHat	8	noarch	candlepin	< 4.3.12-1.el8sat	candlepin-4.3.12-1.el8sat.noarch.rpm
RedHat	8	noarch	python3.11-opentelemetry_exporter_otlp_proto_http	< 1.19.0-5.el8pc	python3.11-opentelemetry_exporter_otlp_proto_http-1.19.0-5.el8pc.noarch.rpm
RedHat	8	noarch	rubygem-smart_proxy_dynflow	< 0.9.1-1.el8sat	rubygem-smart_proxy_dynflow-0.9.1-1.el8sat.noarch.rpm
RedHat	8	x86_64	cjson-debugsource	< 1.7.14-5.el8sat	cjson-debugsource-1.7.14-5.el8sat.x86_64.rpm
RedHat	8	noarch	rubygem-crass	< 1.0.6-2.el8sat	rubygem-crass-1.0.6-2.el8sat.noarch.rpm
RedHat	8	noarch	python3.11-attrs	< 21.4.0-5.el8pc	python3.11-attrs-21.4.0-5.el8pc.noarch.rpm
RedHat	8	noarch	rubygem-deep_cloneable	< 3.2.0-1.el8sat	rubygem-deep_cloneable-3.2.0-1.el8sat.noarch.rpm
RedHat	8	noarch	rubygem-mime-types-data	< 3.2023.1003-1.el8sat	rubygem-mime-types-data-3.2023.1003-1.el8sat.noarch.rpm
RedHat	8	noarch	python3.11-pexpect	< 4.8.0-5.el8pc	python3.11-pexpect-4.8.0-5.el8pc.noarch.rpm

Rows per page:

1-10 of 6211