RHSA-2026:74504 - Security Advisory

Topic

A new release is now available for Red Hat Satellite 6.18 for RHEL 9.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

Description

Red Hat Satellite is a system management solution that allows organizations
to configure and maintain their systems without the necessity to provide
public Internet access to their servers or other client systems. It
performs provisioning and configuration management of predefined standard
operating environments.

Security fix(es):

• foreman: Excessive Permissions for Viewer Role on Preview (CVE-2026-96659)
• python3.12-gitpython: GitPython: Remote Code Execution via Git directory impersonation (CVE-2026-87817)
• python3.12-gitpython: GitPython: Arbitrary file read via TagReference.create() (CVE-2026-78679)
• python3.12-gitpython: GitPython: Arbitrary code execution via improper validation of clone options (CVE-2026-42284)
• python3.12-gitpython: GitPython: Arbitrary command execution due to bypass of dangerous Git option checks (CVE-2026-42215)
• python3.12-dynaconf: Dynaconf: Arbitrary code execution via Server-Side Template Injection (CVE-2026-33154)
• yggdrasil-worker-forwarder: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504)
• yggdrasil-worker-forwarder: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)
• satellite/iop-advisor-backend-rhel9: sqlparse: Denial of Service via quadratic CPU consumption in SQL parsing (CVE-2026-54284)
• python3.12-sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in SQL parsing (CVE-2026-54284)
• satellite/iop-advisor-backend-rhel9: sqlparse: Denial of Service via inefficient SQL parsing (CVE-2026-59893)
• python3.12-sqlparse: sqlparse: Denial of Service via inefficient SQL parsing (CVE-2026-59893)
• python3.12-sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in comment grouping (CVE-2026-71491)
• rubygem-katello: Katello Content View History API Cross-Organization Authorization Bypass (CVE-2026-79654)
• yggdrasil-worker-forwarder: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)
• yggdrasil-worker-forwarder: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)
• yggdrasil-worker-forwarder: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)
• yggdrasil-worker-forwarder: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)
• rubygem-katello: improper authorization logic allows resource enumeration (CVE-2026-56098)
• rubygem-katello: SQL injection in Registry Proxy via labels (CVE-2026-56097)
• rubygem-hammer_cli: command injection via insecure editor invocation (CVE-2026-12545)
• foreman: SSTI and insecure deserialization in foreman-rake configuration (CVE-2026-12544)
• foreman: command injection in foreman-tail (CVE-2026-12542)
• foreman: command injection in foreman-rake database tasks (CVE-2026-12541)
• foreman: command injection in foreman-rake errors:fetch_log via request_id parameter (CVE-2026-12540)
• foreman: unauthenticated information disclosure via provisioning token validation flaw (CVE-2026-12423)
• rubygem-foreman_remote_execution: command injection in job invocations via effective_user parameter (CVE-2026-12405)
• foreman: Safemode Bypass leading to RCE (CVE-2026-96658)

Bug fix(es):

• Issue encountered when using the parent_hostgroup parameter with the ^ operator (SAT-50953)
• PG::InternalError: ERROR: invalid memory alloc request size 1714242091 when using "Host - Available Errata" report template (SAT-50952)

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Satellite 6.18 x86_64
• Red Hat Satellite Capsule 6.18 x86_64
• Red Hat Enterprise Linux for x86_64 9 x86_64

Fixes

• BZ - 2449774 - CVE-2026-33154 dynaconf: jinja2: Dynaconf: Arbitrary code execution via Server-Side Template Injection
• BZ - 2467800 - CVE-2026-42284 GitPython: GitPython: Arbitrary code execution via improper validation of clone options
• BZ - 2467802 - CVE-2026-42215 GitPython: GitPython: Arbitrary command execution due to bypass of dangerous Git option checks
• BZ - 2484204 - CVE-2026-42504 mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header
• BZ - 2488952 - CVE-2026-12405 rubygem-foreman_remote_execution: command injection in job invocations via effective_user parameter
• BZ - 2488956 - CVE-2026-12423 foreman: unauthenticated information disclosure via provisioning token validation flaw
• BZ - 2489969 - CVE-2026-12540 foreman: command injection in foreman-rake errors:fetch_log via request_id parameter
• BZ - 2489970 - CVE-2026-12541 foreman: command injection in foreman-rake database tasks
• BZ - 2489971 - CVE-2026-12542 foreman: command injection in foreman-tail
• BZ - 2489992 - CVE-2026-12544 foreman: SSTI and insecure deserialization in foreman-rake configuration
• BZ - 2489993 - CVE-2026-12545 rubygem-hammer_cli: command injection via insecure editor invocation
• BZ - 2490542 - CVE-2026-56098 rubygem-katello: improper authorization logic allows resource enumeration
• BZ - 2490543 - CVE-2026-56097 rubygem-katello: SQL injection in Registry Proxy via labels
• BZ - 2515815 - CVE-2026-33818 encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal
• BZ - 2515820 - CVE-2026-56860 net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
• BZ - 2515827 - CVE-2026-56853 net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
• BZ - 2515838 - CVE-2026-56858 html/template: golang: Go html/template: Cross-Site Scripting via pathological input
• BZ - 2515839 - CVE-2026-56862 crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages
• BZ - 2517518 - CVE-2026-71491 sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in comment grouping
• BZ - 2517523 - CVE-2026-59893 sqlparse: sqlparse: Denial of Service via inefficient SQL parsing
• BZ - 2517527 - CVE-2026-54284 sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in SQL parsing
• BZ - 2523205 - CVE-2026-78679 GitPython: GitPython: Arbitrary file read via TagReference.create()
• BZ - 2523348 - CVE-2026-79654 katello: Katello Content View History API Cross-Organization Authorization Bypass
• BZ - 2530744 - CVE-2026-87817 GitPython: GitPython: Remote Code Execution via Git directory impersonation
• BZ - 2534185 - CVE-2026-96658 foreman: Safemode Bypass leading to RCE
• BZ - 2536844 - CVE-2026-96659 foreman: Excessive Permissions for Viewer Role on Preview
• SAT-50952 - PG::InternalError: ERROR: invalid memory alloc request size 1714242091 when using "Host - Available Errata" report template [satellite_6.18]
• SAT-50953 - Issue encountered when using the parent_hostgroup parameter with the ^ operator [satellite_6.18]

CVEs

• CVE-2026-12405
• CVE-2026-12423
• CVE-2026-12540
• CVE-2026-12541
• CVE-2026-12542
• CVE-2026-12544
• CVE-2026-12545
• CVE-2026-33154
• CVE-2026-33818
• CVE-2026-42215
• CVE-2026-42284
• CVE-2026-42504
• CVE-2026-54284
• CVE-2026-56097
• CVE-2026-56098
• CVE-2026-56853
• CVE-2026-56858
• CVE-2026-56860
• CVE-2026-56862
• CVE-2026-59893
• CVE-2026-71491
• CVE-2026-78679
• CVE-2026-79654
• CVE-2026-87817
• CVE-2026-96658
• CVE-2026-96659

References

• https://access.redhat.com/security/updates/classification/#critical