RHSA-2024:11574 - Security Advisory

Topic

A new release is now available for Red Hat Satellite 6.16 for RHEL 8 and 9.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

Description

Red Hat Satellite is a system management solution that allows organizations
to configure and maintain their systems without the necessity to provide
public Internet access to their servers or other client systems. It
performs provisioning and configuration management of predefined standard
operating environments.

Security Fix(es):

• aiohttp: aiohttp vulnerable to request smuggling due to incorrect parsing of chunk extensions (CVE-2024-52304)

Users of Red Hat Satellite are advised to upgrade to these updated
packages, which fix these bugs.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For detailed instructions how to apply this update, refer to:

https://access.redhat.com/documentation/en-us/red_hat_satellite/6.16/html/updating_red_hat_satellite/index

Affected Products

• Red Hat Satellite 6.16 for RHEL 9 x86_64
• Red Hat Satellite 6.16 for RHEL 8 x86_64
• Red Hat Satellite Capsule 6.16 for RHEL 9 x86_64
• Red Hat Enterprise Linux for x86_64 9 x86_64
• Red Hat Enterprise Linux for x86_64 8 x86_64
• Red Hat Satellite Extended Update Support 6.16 for RHEL 9 x86_64
• Red Hat Satellite Extended Update Support 6.16 for RHEL 8 x86_64
• Red Hat Satellite Capsule Extended Update Support 6.16 for RHEL 9 x86_64
• Red Hat Satellite Capsule Extended Update Support 6.16 for RHEL 8 x86_64
• Red Hat Satellite Capsule 6.16 for RHEL 8 x86_64

Fixes

• BZ - 2327130 - CVE-2024-52304 aiohttp: aiohttp vulnerable to request smuggling due to incorrect parsing of chunk extensions
• SAT-28560 - A simple search not listing the RHEL 9 EUS repositories.
• SAT-28990 - Cannot delete an organization which contained deleted custom repos after upgrade to 6.16
• SAT-29255 - Confusing wording whether the upgrade is fully done during 6.15 to 6.16 upgrade
• SAT-29340 - OpenJDK 17 not detected correctly by the installer
• SAT-29427 - Red Hat Satellite Upgrade Helper url gives 404 ERROR on the top banner
• SAT-29432 - EOL Date for Sat 6.16 is displayed wrong in the WebUi Banner
• SAT-29697 - Concurrent content sync on a specific capsule 6.16 results in pulpcore-api dumping core
• SAT-29698 - [Bug] - Unable to apply remediation after running leapp preupgrade job from Satellite WebUI
• SAT-29699 - "About subscription watch" link on RH Cloud Inventory page returns "404 Page not found".
• SAT-29700 - Org deletion fails if there are container repositories present
• SAT-29701 - Satellite 6.16 fails with CA signature digest algorithm too weak regardless of crypto-policy
• SAT-29702 - Full Capsule Sync always triggers pulp optimised sync
• SAT-29946 - Failed to genereate report using "Host - Applied Errata" template.
• SAT-29947 - Unable to add future dated subscriptions from the Satellite WebUI
• SAT-29974 - [Bug] - Unable to register cloud VMs with Red Hat Satellite server v6.16.
• SAT-30085 - 500 Internal Server Error when trying to access published URl of kickstart repo after it has been synced

CVEs

• CVE-2024-52304

References

• https://access.redhat.com/security/updates/classification/#moderate
• https://access.redhat.com/documentation/en-us/red_hat_satellite/6.16/html/updating_red_hat_satellite/index