The following advisory data is extracted from: https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_0797.json Red Hat officially shut down their mailing list notifications October 10, 2023. Due to this, Packet Storm has recreated the below data as a reference point to raise awareness. It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment. - Packet Storm Staff ==================================================================== Red Hat Security Advisory Synopsis: Important: Satellite 6.14.2 Async Security Update Advisory ID: RHSA-2024:0797-03 Product: Red Hat Satellite 6 Advisory URL: https://access.redhat.com/errata/RHSA-2024:0797 Issue date: 2024-02-13 Revision: 03 CVE Names: CVE-2023-0809 ==================================================================== Summary: Updated Satellite 6.14 packages that fixes Important security bugs and several regular bugs are now available for Red Hat Satellite. Description: Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity to provide public Internet access to their servers or other client systems. It performs provisioning and configuration management of predefined standard operating environments. Security fix(es): * CVE-2023-26049 (puppetserver): Cookie parsing of quoted values can exfiltrate values from other cookies * CVE-2023-26141 (rubygem-sidekiq): Denial of Service (DoS) in dashboard-charts * CVE-2023-36479 (puppetserver): Improper addition of quotation marks to user inputs in CgiServlet * CVE-2023-38545 (puppet-agent): Heap-based buffer overflow in the SOCKS5 proxy handshake * CVE-2023-40167 (puppetserver): Improper validation of HTTP/1 content-length * CVE-2023-40175 (rubygem-puma): HTTP request smuggling when parsing chunked transfer encoding bodies and zero-length content-length headers * CVE-2023-4785 (rubygem-grpc): File descriptor exhaustion leads to denial of service * CVE-2023-0809, CVE-2023-28366, CVE-2023-3592 (mosquitto): Memory leak leads to unresponsive broker This update fixes the following bugs: 2250347 - 'Sun, 11 Jun 2023 17:51:29 GMT' could not be parsed at index 0 at java.time.format.DateTimeFormatter.parseResolved 2254974 - satellite-convert2rhel-toolkit install fails on latest rpm with `/usr/bin/bash: /usr/libexec/satellite-convert2rhel-appliance/action-install.sh: No such file or directory` 2255260 - 6.14 - satellite-convert2rhel-toolkit is part of the satellite module 2257321 - Request for UEFI Kickstart Provisioning to handle naming convention for VLAN tagged interfaces of the format . in addition to vlan 2257324 - Generate applicability tasks fails with error \"ERROR: insert or update on table \"katello_content_facet_errata\" violates foreign key constraint \"katello_content_facet_errata_ca_id\" 2257326 - Show failed resources in failed installation report 2257327 - Puppet reports without any messages don't get an origin 2257329 - Host registration fails with error \"Attached to can't be blank\" when the VLAN name includes UPPERCASE letters 2257330 - default tuning profile leaves httpd MaxClients 150 which httpd raises a warning 2257331 - Registering host through load balancer causes REX not to know what capsule to choose for 'registered_through' 2257332 - Registration can't find any Capsules when their locations are not assigned to admin user 2257415 - Provisioning vm host fails with error \"Failed to attach ISO image to CDROM drive of instance client.example.com: InvalidPowerState: The attempted operation cannot be performed in the current state (Powered on)\". 2260525 - [Improvement] RefreshRepos step in Capsule Sync to refresh just repos to sync 2262131 - Unable to sync library/busybox from gcr.io Users of Red Hat Satellite are advised to upgrade to these updated packages, which fix these bugs. Solution: https://access.redhat.com/articles/11258 CVEs: CVE-2023-0809 References: https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/documentation/en-us/red_hat_satellite/6.14/html/upgrading_and_updating_red_hat_satellite/index https://bugzilla.redhat.com/show_bug.cgi?id=2232729 https://bugzilla.redhat.com/show_bug.cgi?id=2236341 https://bugzilla.redhat.com/show_bug.cgi?id=2236882 https://bugzilla.redhat.com/show_bug.cgi?id=2239010 https://bugzilla.redhat.com/show_bug.cgi?id=2239017 https://bugzilla.redhat.com/show_bug.cgi?id=2239630 https://bugzilla.redhat.com/show_bug.cgi?id=2239634 https://bugzilla.redhat.com/show_bug.cgi?id=2241933 https://bugzilla.redhat.com/show_bug.cgi?id=2250347 https://bugzilla.redhat.com/show_bug.cgi?id=2254974 https://bugzilla.redhat.com/show_bug.cgi?id=2255260 https://bugzilla.redhat.com/show_bug.cgi?id=2257321 https://bugzilla.redhat.com/show_bug.cgi?id=2257324 https://bugzilla.redhat.com/show_bug.cgi?id=2257326 https://bugzilla.redhat.com/show_bug.cgi?id=2257327 https://bugzilla.redhat.com/show_bug.cgi?id=2257329 https://bugzilla.redhat.com/show_bug.cgi?id=2257330 https://bugzilla.redhat.com/show_bug.cgi?id=2257331 https://bugzilla.redhat.com/show_bug.cgi?id=2257332 https://bugzilla.redhat.com/show_bug.cgi?id=2257415 https://bugzilla.redhat.com/show_bug.cgi?id=2260525 https://bugzilla.redhat.com/show_bug.cgi?id=2262131