RHSA-2025:4576 - Security Advisory

Topic

A new release is now available for Red Hat Satellite 6.17 for RHEL 9.

Red Hat Product Security has classified this update as having a Moderate security impact. Each vulnerability includes a CVSS base score, providing a detailed severity assessment, which can be found via the CVE link(s) in the References section.

Description

Red Hat Satellite is a system management solution that allows organizations to
configure and maintain their systems without the necessity to provide public
Internet access to their servers or other client systems. It performs
provisioning and configuration management of predefined standard operating
environments.

Security Fix(es):

• python-django: Potential denial-of-service vulnerability in IPv6 validation (CVE-2024-56374)
• python-jinja2: Sandbox breakout through indirect reference to format method (CVE-2024-56326)
• rubygem-rack: Local File Inclusion in Rack::Static (CVE-2025-27610)
• rubygem-graphql: Remote code execution when loading a crafted GraphQL schema (CVE-2025-27407)

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:
https://docs.redhat.com/en/documentation/red_hat_satellite/6.17/html/updating_red_hat_satellite/index

Affected Products

• Red Hat Satellite 6.17 x86_64
• Red Hat Satellite Capsule 6.17 x86_64
• Red Hat Enterprise Linux for x86_64 9 x86_64

Fixes

• SAT-12130 - [RFE]: Add location name support for global registration option
• SAT-16243 - [foreman_templates] [rubygem-foreman_templates] Pull 100% completed translations from the Phrase (a.k.a Memsource), and package them into installable build, to determine readiness for Sat-6.13 L10N QA milestone
• SAT-16248 - [foreman_remote_execution] [rubygem-foreman_remote_execution] Pull 100% completed translations from the Phrase (a.k.a Memsource), and package them into installable build, to determine readiness for Sat-6.13 L10N QA milestone
• SAT-16392 - Translation Tracker - Pull 100% completed translations from the Phrase (a.k.a Memsource) for all the Satellite Resources, and package them into installable build, to determine readiness for Satellite L10N QA milestone
• SAT-17448 - Add Disaster Recovery documentation guide
• SAT-17783 - Getting "[Errno -1] Package does not match intended download" error when install rpm
• SAT-19325 - Satellite inventory console log doesn't get cleared.
• SAT-19336 - Default RHEL9 SCAP content does not get populated on the Satellite
• SAT-19505 - Applying foreman.scap role from Satellite on client system where DISA STIG Security Policy is applied locally fails.
• SAT-19515 - To convert "Got multiple version_hrefs for pulp task" error into a warning or suppress it
• SAT-19781 - As usage of katello-ca-consumer rpm has been deprecated, the capsule-certs-generate command should suggest alternate approach during SSL cert installation\renewal
• SAT-19933 - Backups do not take a backup of Ansible configuration files under /etc/ansible
• SAT-20010 - Remove "Organization and Location" option from hammer cli for command "hammer user-group external create --help".
• SAT-20579 - Unable set deploy on "bare metal" in the child hostgroup if its parent hostgroup is set to use a compute resource
• SAT-20586 - When simple content access is enabled, we should not be able to attach subscription to RHEL 7 Client.
• SAT-21359 - "hammer repository upload-content" not long working for docker repository
• SAT-22510 - OSP Authenticated Pull fails from Satellite with error 422 Client Error: Unprocessable Content for url
• SAT-22966 - Errors while deleting repository from Satellite: Unable to find content with the ID "XXXX"
• SAT-23114 - hammer allows creation of content overrides other than 'enabled'
• SAT-23229 - remote_execution_effective_user_password no longer work when switching from one user to another
• SAT-2340 - [RFE] Global Registration: Allow invalidating all JWT registration tokens for a user
• SAT-23647 - Getting "undefined method '#id' for NilClass::Jail (NilClass)" error when generating Ansible inventory report
• SAT-24108 - InsightsCloud::Async::InsightsFullSync task will report in error result if only one Org fails and other succeed
• SAT-24282 - Using hammer to change the hostgroup of a host to a hostgroup that is mapped to a different compute profile tries to update the VM hardware
• SAT-24725 - Add 'other' type for errata filters
• SAT-24795 - Disable the REX pull provider installation in the generated script for Host Content source change.
• SAT-25448 - satellite-installer should always downcase the hostname\fqdn before using them in certs or configurations
• SAT-25464 - Typo in provisioning template 'Linux host_init_config default'
• SAT-2549 - [RFE] Satellite should provide a feature to provision systems with UEFI Secure Boot enabled
• SAT-25949 - [Bug] - satellite-maintain backup command does not include custom answers file in the backup archieve.
• SAT-26058 - [RFE] Add granularity to content count calculations on Capsule
• SAT-26076 - Support --els switch in conversion job template
• SAT-26522 - Python Package Types don't filter out whitespace
• SAT-26537 - Global registration script needs to enable satellite-client repo when chosing REX pull mode
• SAT-26605 - Create a new job_invocations detail page, vol. 2
• SAT-26741 - Http proxy is referenced in postgres even after being removed from the Satellite server
• SAT-26866 - Endeavour: Reach 100% translation for fully supported languages
• SAT-27070 - Content Support for Managing RHEL 10
• SAT-27153 - Updates for image-mode RHEL
• SAT-27221 - Separate the Satellite Inventory Plugin from "host_registration_insights" parameter
• SAT-27308 - noVNC Console for KVM not working due to missing SELinux boolean - websockify
• SAT-27349 - Add support for using a http proxy when syncing templates
• SAT-27369 - Improve the behaviour of 'hammer scap-content bulk-upload --type default' on Satellite to receive the lastest SCAP content.
• SAT-27374 - Add trailing slash to /api/insights/v1/system/<uuid>/reports
• SAT-27388 - Newly provisioned systems get registered directly to the capsule instead of to the load balancer
• SAT-27418 - Upgrade Pulpcore to latest (past 3.55)
• SAT-27420 - [QE] Test n-1 capsule support with Pulpcore 3.63
• SAT-27427 - Syncing fedora-bootc fails
• SAT-27554 - Overly eager branding in HTTP proxy setting description
• SAT-27620 - redhat.satellite.hostgroup and redhat.satellite.host do not allow the creation of parameters with hidden values
• SAT-27627 - Capsule sync is not updating package count for repos inside content view.
• SAT-27675 - Hammer host update false positive when assigning multiple environments
• SAT-27703 - Label option is removed while creating new Organization from Satellite WebUI
• SAT-27717 - Lifecycle environments are not shown when changing the host content source,even if the edit_host permission is granted.
• SAT-27756 - Fields in OS tab don't populate until after failed host import
• SAT-27847 - undefined methods `bootdisk_raise' and 'bootdisk_chain_url'
• SAT-27863 - Add multi-env AK display to hammer activation-key info
• SAT-27874 - The "Synchronize Now" button within Sync Status page of Satellite WebUI does not perform any visible action when the associated Content View is being published
• SAT-27875 - can not re-register rhel against satellite616 on RHEL-10.0-20240908.1 and RHEL-9.5.0-20240908.2
• SAT-27924 - Convert2RHEL job does not have any option to select for '--els'
• SAT-27939 - Syncing ansible collections to Capsule fails with deadlock detected errors
• SAT-27979 - Concurrent content sync on a specific capsule 6.16 results in pulpcore-api dumping core
• SAT-28029 - Large table titles show in All Hosts wizards
• SAT-28060 - getting hosts list performs redundantly huge query over duplicated host IDs
• SAT-28185 - [DOC] Add procedure for updating image-mode RHEL hosts
• SAT-28216 - [Bug] - Unable to apply remediation after running leapp preupgrade job from Satellite WebUI
• SAT-28293 - Issues when using Host Collection membership Management, the number of content hosts is not accurate
• SAT-28311 - As a user I want to be able to configure the pull provider on any version of RHEL in the same way
• SAT-28312 - As a user I want to be able to upgrade RHEL and have the pull provider continue working
• SAT-28337 - Allow capsule content counting for an environment/content view
• SAT-28338 - UI - Refresh count should be able to refresh content count for the selected env.
• SAT-28356 - foreman-maintain upgrade can't re-run already run phases
• SAT-28443 - remote_execution_ssh_keys template does not set proper sudoers file permissions
• SAT-28464 - Failed to import ansible collections with "duplicate key value violates unique" error
• SAT-28471 - As a user I can manage and scan flatpak remotes via API and Hammer
• SAT-28472 - As a user, I can import remote flatpak repositories into Katello
• SAT-28486 - Libvirt compute resource use IDE cdrom which is not supported on Q35 hypervisor
• SAT-28493 - Unable to add subscription to the empty manifest on Satellite
• SAT-28526 - satellite-maintain health check and service status reports external database as fail if the password has special character
• SAT-28538 - Display LCEs in order of LCE Path in GUI CV Page and hammer for Content View?
• SAT-28552 - Unable to change the system purpose for the hypervisor.
• SAT-28553 - Installer should enable FLATPAK_INDEX for pulp registry
• SAT-28556 - As a client I should be able to add flatpak remote pointing to Satellite
• SAT-28575 - Full Capsule Sync always triggers pulp optimised sync
• SAT-28613 - Registering a host with non-admin user with "Register hosts" role doesn't move the host in specified location
• SAT-28662 - Container push should hide expected 404 message from pulp when looking up blobs
• SAT-28735 - Can't remove a version from an environment if it is being used by a multi-CV activation key.
• SAT-28743 - "undefined method" error for hammer capsule content info
• SAT-28756 - pulpcore-[content,api]/PostgreSQL/Python 3.11 issues on shutdown
• SAT-28818 - yggdrasil requires a build dependency /usr/bin/pkg-config
• SAT-28823 - Deprecation of iPXE support
• SAT-28826 - Foreman proxy scap cron job fails with error /etc/scl/conf/tfm not found
• SAT-28856 - Installed products report fails with Jail issue for #purpose_role and #purpose_usage
• SAT-28894 - podman login via smart proxy fails on GMT+x timezones
• SAT-28981 - Activation key doesn't get LCE/CV assigned to it on creation
• SAT-28994 - "About subscription watch" link on RH Cloud Inventory page returns "404 Page not found".
• SAT-29017 - Ansible playbook execution fails for Hosts: localhost
• SAT-29058 - Update foreman_ansible translations
• SAT-29062 - Filtering tasks by starting time is off by an hour
• SAT-29068 - Update foreman_puppet translations
• SAT-29070 - Update foreman_google translations
• SAT-29090 - Ansible collection capsule sync doesn't respect optimized:false value
• SAT-29203 - Unable to add future dated subscriptions from the Satellite WebUI
• SAT-29209 - generic content units controller api translation broken
• SAT-29212 - UI Error when importing templates
• SAT-29214 - Major version accepts negative values while creating operating system
• SAT-29314 - Rendering Arf report index page is causing high memory consumption in Puma workers
• SAT-29322 - Satellite 6.16 fails with CA signature digest algorithm too weak regardless of crypto-policy
• SAT-29332 - foreman-bootloaders-redhat-tftpboot fails as it expects shim-ia32 on EL9
• SAT-29345 - Deleting a CV version does not scale when a product has too many repos (cloned in CVs)
• SAT-29347 - New All hosts: Delete host redirects to old hosts list regardless of setting
• SAT-29454 - Registering bootc host fails to set up ssh keys
• SAT-29469 - Smart proxy content page console error when count is {}
• SAT-29567 - Refresh content counts action on Smart proxy fails when content_counts is set to {}
• SAT-29596 - Failed to generate report using "Host - Applied Errata" template.
• SAT-29622 - Add lxc* pattern to IGNORED_INTERFACES list in Satellite settings.
• SAT-29623 - User last login time is not updated when login with external authentication
• SAT-29667 - ansible-lint not shipped on EL9
• SAT-29670 - 500 Internal Server Error when trying to access published URl of kickstart repo after it has been synced
• SAT-29675 - Insights-client on RHEL10 with Satellite: Backtrace for 'Action failed' error (NameError): uninitialized constant ForemanRhCloud::VERSION
• SAT-29679 - LCE id is not passed on Refresh counts trigger from WebUI
• SAT-29794 - [Bug] - Unable to register cloud VMs with Red Hat Satellite server v6.16.
• SAT-29863 - "running pulpcore tasks" check fails when pulp cli reports warnings
• SAT-29939 - Capsule server fails to create realm entry
• SAT-29945 - Sync error after changing Mirroring Policy: Additive -> Complete Mirroring
• SAT-29950 - Compute profile for EC2, the EC2 subnet is not available
• SAT-29957 - view_job_invocations permission doesn't show up under JobInvocation resource type
• SAT-30004 - RH Cloud action history has wrong name and shows 0 results
• SAT-30014 - Reruning interupted content import fails
• SAT-30043 - Hammer AK content-override fails on force flag
• SAT-30070 - Satellite upgrade of Postgres 12 to 13 fails if`/var/lib/pgsql/data` is a direct mount
• SAT-30098 - Incorrect network displayed while host import from compute resources
• SAT-30102 - Satellite backup showing error code from dynflow-sidekiq@worker-1.service
• SAT-30106 - Auth token of flatpak-remote is returned by API
• SAT-30108 - Resource Type for flatpak permissions
• SAT-30112 - [DOC][Update] Support --els switch in conversion job template
• SAT-30118 - Products index page is slow for products that have no synced repositories
• SAT-30138 - A 'Media' field is unexpectedly showing up in Red Hat Satellite's web UI on the 'Operating System' tab of a child host group
• SAT-30141 - Pull provider jobs failing with Proxy error: ArgumentError - wrong number of arguments (given 3, expected 1..2)
• SAT-30152 - Unable to leapp a server when using channel other than GA
• SAT-30154 - Typo in displayed message from the upgrade checks of satellite-maintain
• SAT-30167 - satellite-clone failing to restore with fapolicyd running
• SAT-30172 - [DOC][Update] IPv6 support for TFTP-boot provisioning
• SAT-30176 - Stop installing postgresql-evr on Satellite installations
• SAT-30186 - Installation with puppet-agent 8 fails when using a sha1 CA certificate
• SAT-30188 - Hammer should provide the option to add an environment after Library to an existing path
• SAT-30209 - Reassigning host content views when removing Content view version/environment in multi-CV hosts
• SAT-30220 - "ERF42-0328 [Foreman::Exception]: Name has already been taken" error is showing on "Test Connection" to check HTTP Proxy from Satellite Web UI.
• SAT-30227 - Set Synchronize recommendations Automatically setting to true by default
• SAT-30228 - [DOC][Update] IPv6 requirements
• SAT-30314 - When the "server_ca_cert" is set and has an empty line, it will fail
• SAT-30342 - Pulp_container expects 'jwk' in schema_1 manifest but it's optional
• SAT-30374 - [RFE] Hint to enable settings 'allow_multiple_content_views' in hammer ak command
• SAT-30378 - Image mode digests should be allowed to be empty
• SAT-30403 - The pulpcore_registry returns 500 when a flatpak repo is mirrored after reclaim space
• SAT-30443 - can't unset the remote_execution_ssh_password setting
• SAT-30464 - [DOC] Missing documentation for adding virtual TPM chip option and permissions required for VMware user, while provisioning the hosts
• SAT-30491 - content_view_environments methods need to be added to Safemode
• SAT-30541 - Flatpak client unable to do authenticated pull from smart proxy
• SAT-30543 - FakeActivationKey doesn't respond to #organization method
• SAT-30544 - [DOC] Document flatpak workflow in satellite
• SAT-30577 - System Build submission fails with error Name has already been taken when subscribed to Build Entered shellhook
• SAT-30611 - The "Host - Applied Errata" report shows all errata that are already applied on a content host irrespective of the date specified
• SAT-30614 - When there is slow network connectivity sometimes rh_cloud logs a undefined code
• SAT-30625 - Capsule sync or some Satellite's repo sync gets stuck forever since upgrade to 6.16
• SAT-30636 - Add RHEL 10 to repo version restriction logic.
• SAT-30637 - Importing into a repository that already exists on the importing instance broken
• SAT-30669 - Use new host page setting to link to hosts index from content view details page
• SAT-30686 - Repository > New form doesn't render properly
• SAT-30715 - Issues on sat6.16 when provisioning rhel9
• SAT-30717 - Hammer creates AK without expected error message
• SAT-30726 - Pulpcore password hash is incorrect when pulpcore database username is pulpcore but not pulp
• SAT-30761 - Ansible Callback does not work when using AAP 2.5
• SAT-30767 - Fix invalid self-closing tags on angular pages
• SAT-30785 - 'Select all' on errata page attempts installing extra errata on host
• SAT-30790 - Compute Resource create form has pre-populated `provider` value as `Azure Resource Manager`
• SAT-30815 - Flatpak rex templates don't appear in order
• SAT-30841 - FIPS Installation fails during db:migrate with OpenSSL::Digest::DigestError
• SAT-30846 - Argument list too long in "Install errata by search query - Katello Ansible Default" when applying multiple errata
• SAT-30869 - While creating a user, the system does not select the default language and timezone; instead, it sets the language to 'Catala'.
• SAT-30916 - Content views list duplicate relations for multiCV hosts and activation keys
• SAT-30961 - In new hosts index page - run ansible job does nothing
• SAT-30962 - Cluster field is pre-selected for VMware CR while creating a host and freezes the page when selecting anything from the storage section
• SAT-30967 - Sync Status page Select None not working
• SAT-30970 - foreman-maintain service restart fails after enabling debug mode on Satellite
• SAT-31040 - New host UI removes newlines and trailing spaces from Ansible variables
• SAT-31105 - Disconnected self-upgrade command is lacking --maintenance-repo-label option
• SAT-31111 - In Satellite 6.17, Remote execution via Hybrid Cloud Console fails with Failed rendering template: error during rendering: uninitialized constant ForemanRhCloud::UrlRemediationsRetriever Did you mean? ForemanRhCloud::URLRemediationsRetriever
• SAT-31157 - Failure occurs after selecting the correct value while creating an Ansible variable.
• SAT-31160 - Extra tbody left inside booted containers table causes automation issues"
• SAT-31193 - UX request: host index image mode column should be "Type"
• SAT-31196 - [Doc] Add Doc Note that vit-who does not support IPv6 for 6.17
• SAT-31203 - The filter option is not functioning correctly during the provisioning of a discovery host.
• SAT-31220 - in host edit, unselecting media causes page freeze
• SAT-31241 - page scroll freeze in host edit unselect architecture
• SAT-31308 - Job template "Set up Flatpak remote" fails when /run/containers/0/auth.json is missing
• SAT-31315 - Remote execution running transactions are not completely visible on Satellite WebUI
• SAT-31316 - satellite-installer fails when foreman-proxy-dhcp is enabled
• SAT-31338 - Puppet plugin purge command fails mentioning disable Puppet from Satellite along external capsule first
• SAT-31351 - Update Recommeneded Repositories Page to modify Satellite, Capsule and Maintainance repository from 6.16 to 6.17 for RHEL 9
• SAT-31398 - satellite-maintain upgrade/update fails to detect current version on capsule
• SAT-31451 - [QE][AUTOMATION] The "Host - Applied Errata" report shows all errata that are already applied on a content host irrespective of the date specified
• SAT-31475 - mismatch between hammer full-help and the output of per-command --help
• SAT-31479 - The forward and backward navigations are non-functional in the Logs page of Capsules
• SAT-31502 - deb_enable_structured_apt setting should not be visible in Satellite 6.17 if Debian content management is not enabled and supported
• SAT-31526 - VM is not displayed on sat for GCE Compute Resource.
• SAT-31588 - Could not establish a connection to the SSH agent during the provisioning of Azure and GCE.
• SAT-31602 - check-tftp-storage is not available in foreman-maintain health list for Satellite 6.17.0
• SAT-31645 - The HW properties card shows RAM information from dmi.memory.maximum_capacity instead of using memory.memtotal fact value
• SAT-31813 - Rename RH Cloud tab in Settings to Insights
• SAT-31814 - Bootc Card on Host Details UI has incorrect component id
• SAT-32426 - Creation of File type Red Hat repositories fails
• SAT-32447 - in host create, selecting image mode does nothing
• SAT-32467 - [Sat617] Assigning ?multiple CVs to a client fails with error 500 when allow_multiple_content_views setting is disabled
• SAT-32604 - RPM installation resolves `pulpcore-api` core dumps during concurrent repository synchronization
• SAT-32605 - Organization deletion failure caused by container push repositories
• SAT-5118 - [RFE]Creating a new HTTP Proxy in satellite GUI should have an option to automatically update/set the "Default HTTP Proxy setting", in the "Administer menu" .
• SAT-6776 - Backlog option in foreman.socket is lower than RHEL 9 default value

CVEs

• CVE-2024-56326
• CVE-2024-56374
• CVE-2025-27407
• CVE-2025-27610

References

• https://access.redhat.com/security/updates/classification/#important