Red Hat Product Errata RHSA-2023:5980 - Security Advisory
Issued:
2023-10-20
Updated:
2023-10-20

RHSA-2023:5980 - Security Advisory

Synopsis

Important: Satellite 6.11.5.6 async security update

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

Updated Satellite 6.11 packages that fix several bugs are now available for Red Hat Satellite.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity to provide public Internet access to their servers or other client systems. It performs provisioning and configuration management of predefined standard operating environments.

Security fix(es):

  • golang: net/http, x/net/http2: rapid stream resets can cause excessive work (Rapid Reset) (CVE-2023-39325)
  • HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset) (CVE-2023-44487)

A Red Hat Security Bulletin which addresses further details about the Rapid Reset flaws is available in the References section.

  • ruby-git: code injection vulnerability (CVE-2022-46648)
  • ruby-git: code injection vulnerability (CVE-2022-47318)
  • Foreman: Arbitrary code execution through templates (CVE-2023-0118)
  • Satellite/Foreman: Arbitrary code execution through yaml global parameters (CVE-2023-0462)
  • openssl: c_rehash script allows command injection (CVE-2022-1292)
  • openssl: the c_rehash script allows command injection (CVE-2022-2068)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update fixes the following bugs:

2159417 - CVE-2023-0118 foreman: Arbitrary code execution through templates [rhn_satellite_6.11]
2163523 - CVE-2023-0462 foreman: Satellite/Foreman: Arbitrary code execution through yaml global parameters [rhn_satellite_6.11]
2242355 - CVE-2022-1292 CVE-2022-2068 puppet-agent for Satellite and Capsule: various flaws [rhn_satellite_6.11]
2242360 - CVE-2022-47318 tfm-rubygem-git: ruby-git: code injection vulnerability [rhn_satellite_6.11]
2242364 - CVE-2022-46648 rubygem-git: ruby-git: code injection vulnerability [rhn_satellite_6.11]
2243832 - [Major Incident] CVE-2023-39325 CVE-2023-44487 yggdrasil-worker-forwarder: various flaws [rhn_satellite_6.11]

Users of Red Hat Satellite are advised to upgrade to these updated packages,
which fix these bugs.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Satellite 6.11 for RHEL 8 x86_64
  • Red Hat Satellite 6.11 for RHEL 7 x86_64
  • Red Hat Satellite Capsule 6.11 for RHEL 8 x86_64
  • Red Hat Satellite Capsule 6.11 for RHEL 7 x86_64
  • Red Hat Enterprise Linux for x86_64 8 x86_64
  • Red Hat Enterprise Linux Server 7 x86_64

Fixes

  • BZ - 2081494 - CVE-2022-1292 openssl: c_rehash script allows command injection
  • BZ - 2097310 - CVE-2022-2068 openssl: the c_rehash script allows command injection
  • BZ - 2159291 - CVE-2023-0118 Foreman: Arbitrary code execution through templates
  • BZ - 2159672 - CVE-2022-47318 ruby-git: code injection vulnerability
  • BZ - 2162970 - CVE-2023-0462 Satellite/Foreman: Arbitrary code execution through yaml global parameters
  • BZ - 2169385 - CVE-2022-46648 ruby-git: code injection vulnerability
  • BZ - 2242803 - CVE-2023-44487 HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)
  • BZ - 2243296 - CVE-2023-39325 golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)

Red Hat Satellite 6.11 for RHEL 8

SRPM
foreman-3.1.1.27-1.el8sat.src.rpm SHA-256: 7d120e5744a115020755c1841a78e0d74ef4b2e097b36b5040987b2c68d7c021
puppet-agent-7.26.0-3.el8sat.src.rpm SHA-256: b74e9a66ede61765c6e831331ea39b231079b654c81e6f3bf7516a246cf6fcca
rubygem-git-1.18.0-0.1.el8sat.src.rpm SHA-256: ffe561749a4f3df71bf3b6c47b3057277d2cc4e4a1478d56e2053eadfc4746c3
rubygem-rchardet-1.8.0-0.1.el8sat.src.rpm SHA-256: 680d9e124b67da26fc471a804f4e807079c5157874e731183f3cd051f07b5f79
rubygem-safemode-1.3.8-0.1.el8sat.src.rpm SHA-256: b087868da7ffb4c75b52f6d3e7f2e34f0581d8d9e5f54f8f418681a6326ce8b1
satellite-6.11.5.6-1.el8sat.src.rpm SHA-256: 8698aab38978a8329cc64748cf7349d47b2d7fe29cff9b6a8a31b8c7b08875a9
yggdrasil-worker-forwarder-0.0.3-1.el8sat.src.rpm SHA-256: 45854be1e160d0056c61e509c3463beaf4aafbdef825ea9d10e6699fab906d6e
x86_64
foreman-3.1.1.27-1.el8sat.noarch.rpm SHA-256: 76ea383995c2807733bfa869f62084c5052a65682a95faa6d42da6a64ec6f238
foreman-cli-3.1.1.27-1.el8sat.noarch.rpm SHA-256: a84fa58dea85c689b7df7c859eda597db54442aaf40463d34d6f1abb1454b4cb
foreman-debug-3.1.1.27-1.el8sat.noarch.rpm SHA-256: e083a79af05c6df97a190aa7313b3e7b757dddf2c3bdaa490d4c34b7a321bb9d
foreman-dynflow-sidekiq-3.1.1.27-1.el8sat.noarch.rpm SHA-256: f619ecab4d5c456447712e58982343c5cbbe0d1fe393cbe06dda2dc8b5f856db
foreman-ec2-3.1.1.27-1.el8sat.noarch.rpm SHA-256: 869f01757b67b95085a717e09c30d5ebc4406d544caf18179ebb5e56689ebd47
foreman-gce-3.1.1.27-1.el8sat.noarch.rpm SHA-256: 084643cba2d6754ce12b9d25d99058d56bc0632da0bb64921ae39adebb86dddb
foreman-journald-3.1.1.27-1.el8sat.noarch.rpm SHA-256: 122aa73c01c51379420d06c36bb9dc8e2b517c9cee2a40a45149b242464be001
foreman-libvirt-3.1.1.27-1.el8sat.noarch.rpm SHA-256: 2242193566ef95e8f3910b4930b2310d2dc35c5fa3932cf783c24e52c3f46343
foreman-openstack-3.1.1.27-1.el8sat.noarch.rpm SHA-256: 2b4a06dd834d60defc5e42efc6bdc0847f214b707d79be302bff0d63877a4438
foreman-ovirt-3.1.1.27-1.el8sat.noarch.rpm SHA-256: bfd02ba5f35157a3542e7fc4a4652ab03e0c3d589c3a5f8cd252aeec5e3bfbc4
foreman-postgresql-3.1.1.27-1.el8sat.noarch.rpm SHA-256: ef6858d7e21f23afe72e00764ac9a132360f28fa4fb9de2fd00f73136420620f
foreman-service-3.1.1.27-1.el8sat.noarch.rpm SHA-256: 626806506e96e7e43cee46202a846218710b55e4687488697abd2d8ef9e3305a
foreman-telemetry-3.1.1.27-1.el8sat.noarch.rpm SHA-256: 4cd254575da530a557c75086ab546749b588c2af58c4b236624809ab8f16b229
foreman-vmware-3.1.1.27-1.el8sat.noarch.rpm SHA-256: 26679dca807b755e04a4b1b2a436c43c7ebe9a07556dc1f26dd41bfdb267fdd2
puppet-agent-7.26.0-3.el8sat.x86_64.rpm SHA-256: cc4bf1c0903e4e5c32eb7842fef51b10a8554883e3db5ed5214ec9003b2c400d
rubygem-git-1.18.0-0.1.el8sat.noarch.rpm SHA-256: 191d0a49cb654bea9b2ddf465e7eb33eb173f5ac44421819a4d94aef6b489f5c
rubygem-rchardet-1.8.0-0.1.el8sat.noarch.rpm SHA-256: 1d294d7c2abc77a17d074a7f35cc8a37443be4c9a00b2f5d504f4492fb7a96be
rubygem-safemode-1.3.8-0.1.el8sat.noarch.rpm SHA-256: 9becdaf38800a57173e1be6bf5d8525f2418e673a450dd1cca47a3644c5a3317
satellite-6.11.5.6-1.el8sat.noarch.rpm SHA-256: 9f7ad3dac3e86c43f6dbdf9a75e18598eafd7c40358c44504868206315863a5b
satellite-cli-6.11.5.6-1.el8sat.noarch.rpm SHA-256: 3d0b0c76a75fe773b8df1b10ebfefd07f8900bd208b6f8a623f1eca6ec40f105
satellite-common-6.11.5.6-1.el8sat.noarch.rpm SHA-256: d9d66fcd19adfea55cb645bcf330c14c7b66a47bd453902cc050590c65d07f77
yggdrasil-worker-forwarder-0.0.3-1.el8sat.x86_64.rpm SHA-256: 083c3b580f7053ddc97446dd7b64f97d6874c5d5e4448bc9c66f98b58f8a5afc

Red Hat Satellite 6.11 for RHEL 7

SRPM
foreman-3.1.1.27-1.el7sat.src.rpm SHA-256: d77a5ea8db35fae37c9d0c9026929a5a3e089a2aa15480e05380a8dbde870fdc
puppet-agent-7.26.0-3.el7sat.src.rpm SHA-256: db4a5b72eb68763e4e95e00d1764646b09809f95a97b625ea2552cf87c87909a
satellite-6.11.5.6-1.el7sat.src.rpm SHA-256: eacb64a6868af7803d6c32ee7f349f37c000e6173a3252133ae35fd525bd0b1e
tfm-rubygem-git-1.18.0-0.1.el7sat.src.rpm SHA-256: a135ee2f930136fc6556bc58318634813c2c7b19bb4df44c66f68fb7c074d83a
tfm-rubygem-rchardet-1.8.0-0.1.el7sat.src.rpm SHA-256: 26f7c67ac0a9d81ee5292691873abd2b9c8f997d8082d2cb94dcbdb9859ea7ac
tfm-rubygem-safemode-1.3.8-0.1.el7sat.src.rpm SHA-256: cb49f5bfbc98089614a2bb72309ba36192cb4e5e296f6c49c85d6d85076fd51b
yggdrasil-worker-forwarder-0.0.3-1.el7sat.src.rpm SHA-256: 7823c6a6210937061b2d379b907aa7a3243875ea8b9cb58b63b01ad1e01fc48b
x86_64
foreman-3.1.1.27-1.el7sat.noarch.rpm SHA-256: a3cf5a16a3e7947bc56c2e103761cdf4f7cc75f4b85389be84d321401d87c352
foreman-cli-3.1.1.27-1.el7sat.noarch.rpm SHA-256: 06fc734badf69092285440e54e0552ccf6a798ae66e3fb5fd7dbb062a09234b9
foreman-debug-3.1.1.27-1.el7sat.noarch.rpm SHA-256: b1b395a578fa831344169f123b9da35ba844a48d272675a3a1069bfcabc22ebd
foreman-dynflow-sidekiq-3.1.1.27-1.el7sat.noarch.rpm SHA-256: fd5b28e3c783b141feeb8aa6bdb6d71ba866f5724f6da335b8c4a26f55b4141a
foreman-ec2-3.1.1.27-1.el7sat.noarch.rpm SHA-256: 68d334b322d0fe46c180d9919df8a4ce63093131f74d7694e26a5d401f887727
foreman-gce-3.1.1.27-1.el7sat.noarch.rpm SHA-256: 235231dfee309bcba3f9862c5c3eec45bc444191de9407b321cdd2a4eb44f1cf
foreman-journald-3.1.1.27-1.el7sat.noarch.rpm SHA-256: 49fe98433dad8683f9ab7922e0b19878d3139c1a082733ee3914c42c5ee1a100
foreman-libvirt-3.1.1.27-1.el7sat.noarch.rpm SHA-256: 611ed6bf2cd36e65e228cfc23734781467cc166284c3fe8878fa1bbbe6fd0202
foreman-openstack-3.1.1.27-1.el7sat.noarch.rpm SHA-256: 9afaeb271b3ec772d24a2b3051d77175a22651d4def31c18a772ba2ab122ad99
foreman-ovirt-3.1.1.27-1.el7sat.noarch.rpm SHA-256: e544e4c19425b4069479649b92c09831675c80e08b089d7e115f3e181c78bcd0
foreman-postgresql-3.1.1.27-1.el7sat.noarch.rpm SHA-256: 477e149ad8cfdf563bf288aebaf64df4635aeb6dc7f35f0ee857ddb9d84eac4b
foreman-service-3.1.1.27-1.el7sat.noarch.rpm SHA-256: 41b9fff3128457c706d69f581c00b5e3b659004b0824cbe4296b9b0410f3fd1a
foreman-telemetry-3.1.1.27-1.el7sat.noarch.rpm SHA-256: 8dec19c4425fb3aedcc3c5ee3a599c1bdd1457b65c8271c8a47ab002879b6f54
foreman-vmware-3.1.1.27-1.el7sat.noarch.rpm SHA-256: c3f7bc58d91d73e55a73ce04d38b819470c7ce7ee60d0047c5d2072f9808ae55
puppet-agent-7.26.0-3.el7sat.x86_64.rpm SHA-256: c7b0bbf26909d7989bd85cc95dc64ff1948d44c4a4543b5ea8c3e413ebcd540e
satellite-6.11.5.6-1.el7sat.noarch.rpm SHA-256: 829878bd7bab6512dd9f6b532c1352c1b0d8c3b39df77ad7c5e973cb56938ddb
satellite-cli-6.11.5.6-1.el7sat.noarch.rpm SHA-256: d49ea5b3033516a544b9f210ef17be5a205abe7758cf41eb66e11f9bc84ef971
satellite-common-6.11.5.6-1.el7sat.noarch.rpm SHA-256: 59640d3028ed417d1bbc7ec3e503108ea1a5b2fbd67dd34bf050e79e8ea8ac70
tfm-rubygem-git-1.18.0-0.1.el7sat.noarch.rpm SHA-256: 879e47c51d1590f21436707bd1bbe4221c5d933c0dcd57dd62cf280180ed80ca
tfm-rubygem-rchardet-1.8.0-0.1.el7sat.noarch.rpm SHA-256: 89c9a4410490d1e6de98ccadbb679ccbb418c2569968207319c0553991f215b9
tfm-rubygem-safemode-1.3.8-0.1.el7sat.noarch.rpm SHA-256: 7afb6f9749a390fe4946ec5b55587cd412ddf55245091ce322083fa245f185cf
yggdrasil-worker-forwarder-0.0.3-1.el7sat.x86_64.rpm SHA-256: 337211c70fe8b42cd08a2491b5605e6a0c5334f5edcadab20f42e7252d6fe586

Red Hat Satellite Capsule 6.11 for RHEL 8

SRPM
foreman-3.1.1.27-1.el8sat.src.rpm SHA-256: 7d120e5744a115020755c1841a78e0d74ef4b2e097b36b5040987b2c68d7c021
puppet-agent-7.26.0-3.el8sat.src.rpm SHA-256: b74e9a66ede61765c6e831331ea39b231079b654c81e6f3bf7516a246cf6fcca
satellite-6.11.5.6-1.el8sat.src.rpm SHA-256: 8698aab38978a8329cc64748cf7349d47b2d7fe29cff9b6a8a31b8c7b08875a9
x86_64
foreman-debug-3.1.1.27-1.el8sat.noarch.rpm SHA-256: e083a79af05c6df97a190aa7313b3e7b757dddf2c3bdaa490d4c34b7a321bb9d
puppet-agent-7.26.0-3.el8sat.x86_64.rpm SHA-256: cc4bf1c0903e4e5c32eb7842fef51b10a8554883e3db5ed5214ec9003b2c400d
satellite-capsule-6.11.5.6-1.el8sat.noarch.rpm SHA-256: ca99656510c59db82806cbae0faf8407326570500d81a186b965d967500f9718
satellite-common-6.11.5.6-1.el8sat.noarch.rpm SHA-256: d9d66fcd19adfea55cb645bcf330c14c7b66a47bd453902cc050590c65d07f77

Red Hat Satellite Capsule 6.11 for RHEL 7

SRPM
foreman-3.1.1.27-1.el7sat.src.rpm SHA-256: d77a5ea8db35fae37c9d0c9026929a5a3e089a2aa15480e05380a8dbde870fdc
puppet-agent-7.26.0-3.el7sat.src.rpm SHA-256: db4a5b72eb68763e4e95e00d1764646b09809f95a97b625ea2552cf87c87909a
satellite-6.11.5.6-1.el7sat.src.rpm SHA-256: eacb64a6868af7803d6c32ee7f349f37c000e6173a3252133ae35fd525bd0b1e
x86_64
foreman-debug-3.1.1.27-1.el7sat.noarch.rpm SHA-256: b1b395a578fa831344169f123b9da35ba844a48d272675a3a1069bfcabc22ebd
puppet-agent-7.26.0-3.el7sat.x86_64.rpm SHA-256: c7b0bbf26909d7989bd85cc95dc64ff1948d44c4a4543b5ea8c3e413ebcd540e
satellite-capsule-6.11.5.6-1.el7sat.noarch.rpm SHA-256: 76bd328ee3af32c3c25a3fc6a902feee873dc16bc98c38b27216c6eb364c983c
satellite-common-6.11.5.6-1.el7sat.noarch.rpm SHA-256: 59640d3028ed417d1bbc7ec3e503108ea1a5b2fbd67dd34bf050e79e8ea8ac70

Red Hat Enterprise Linux for x86_64 8

SRPM
foreman-3.1.1.27-1.el8sat.src.rpm SHA-256: 7d120e5744a115020755c1841a78e0d74ef4b2e097b36b5040987b2c68d7c021
satellite-6.11.5.6-1.el8sat.src.rpm SHA-256: 8698aab38978a8329cc64748cf7349d47b2d7fe29cff9b6a8a31b8c7b08875a9
x86_64
foreman-cli-3.1.1.27-1.el8sat.noarch.rpm SHA-256: a84fa58dea85c689b7df7c859eda597db54442aaf40463d34d6f1abb1454b4cb
satellite-cli-6.11.5.6-1.el8sat.noarch.rpm SHA-256: 3d0b0c76a75fe773b8df1b10ebfefd07f8900bd208b6f8a623f1eca6ec40f105

Red Hat Enterprise Linux Server 7

SRPM
foreman-3.1.1.27-1.el7sat.src.rpm SHA-256: d77a5ea8db35fae37c9d0c9026929a5a3e089a2aa15480e05380a8dbde870fdc
satellite-6.11.5.6-1.el7sat.src.rpm SHA-256: eacb64a6868af7803d6c32ee7f349f37c000e6173a3252133ae35fd525bd0b1e
x86_64
foreman-cli-3.1.1.27-1.el7sat.noarch.rpm SHA-256: 06fc734badf69092285440e54e0552ccf6a798ae66e3fb5fd7dbb062a09234b9
satellite-cli-6.11.5.6-1.el7sat.noarch.rpm SHA-256: d49ea5b3033516a544b9f210ef17be5a205abe7758cf41eb66e11f9bc84ef971

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.