RHSA-2026:74505 - Security Advisory

Topic

An update is now available for Red Hat Satellite 6.17 for RHEL 9.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity to provide public Internet access to their servers or other client systems. It performs provisioning and configuration management of predefined standard operating environments.

Security Fix(es):

• foreman: Excessive Permissions for Viewer Role on Preview (CVE-2026-96659)
• foreman: Safemode Bypass leading to RCE (CVE-2026-96658)
• Dynaconf: Arbitrary code execution via Server-Side Template Injection (CVE-2026-33154)
• GitPython: Arbitrary file read via TagReference.create() (CVE-2026-78679)
• GitPython: Remote Code Execution via Git directory impersonation (CVE-2026-87817)
• GitPython: Remote Code Execution via Git directory impersonation (CVE-2026-87817)
• python-gitpython: GitPython: Arbitrary code execution via improper validation of clone options (CVE-2026-42284)
• python-gitpython: GitPython: Arbitrary command execution due to bypass of

dangerous Git option checks (CVE-2026-42215)

• python-gitpython: GitPython: Arbitrary File Overwrite via improper git option validation (CVE-2026-73624)
• python-gitpython: GitPython: Arbitrary file overwrite and read via unsafe git option forwarding (CVE-2026-73620)
• python-gitpython: GitPython: Information disclosure via environment variable expansion in URL handling (CVE-2026-73622)
• python-gitpython: GitPython: Remote Code Execution via kwarg value smuggling (CVE-2026-73625)
• python-gitpython: GitPython: Remote Code Execution via malicious Git template (CVE-2026-73623)
• Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)
• Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)
• Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504)
• Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)
• Katello Content View History API Cross-Organization Authorization Bypass (CVE-2026-79654)
• golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)
• yggdrasil-worker-forwarder: Go net/http: Unencrypted HTTP/2 connections

vulnerable to Denial of Service (CVE-2026-56853)

• lxml: URL bypass vulnerability in Cleaner via missing xlink:href (CVE-2026-49825)
• sqlparse: Denial of Service via inefficient SQL parsing (CVE-2026-59893)
• sqlparse: Denial of Service via quadratic CPU consumption in SQL parsing (CVE-2026-54284)
• sqlparse: Denial of Service via quadratic CPU consumption in comment grouping (CVE-2026-71491)
• rubygem-foreman_remote_execution: command injection in job invocations via effective_user parameter (CVE-2026-12405)
• foreman: unauthenticated information disclosure via provisioning token validation flaw (CVE-2026-12423)
• foreman: command injection in foreman-rake errors:fetch_log via request_id parameter (CVE-2026-12540)
• foreman: command injection in foreman-rake database tasks (CVE-2026-12541)
• foreman: command injection in foreman-tail (CVE-2026-12542)
• foreman: SSTI and insecure deserialization in foreman-rake configuration (CVE-2026-12544)
• rubygem-hammer_cli: command injection via insecure editor invocation (CVE-2026-12545)
• rubygem-katello: SQL injection in Registry Proxy via labels (CVE-2026-56097)
• rubygem-katello: improper authorization logic allows resource enumeration (CVE-2026-56098)

Bug Fix(es):

• Issue encountered when using the parent_hostgroup parameter with the ^ operator (SAT-50545)
• PG::InternalError: ERROR: invalid memory alloc request size 1714242091 when using "Host - Available Errata" report template (SAT-50544)

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Satellite 6.17 x86_64
• Red Hat Satellite Capsule 6.17 x86_64
• Red Hat Enterprise Linux for x86_64 9 x86_64

Fixes

• BZ - 2449774 - CVE-2026-33154 dynaconf: jinja2: Dynaconf: Arbitrary code execution via Server-Side Template Injection
• BZ - 2467800 - CVE-2026-42284 GitPython: GitPython: Arbitrary code execution via improper validation of clone options
• BZ - 2467802 - CVE-2026-42215 GitPython: GitPython: Arbitrary command execution due to bypass of dangerous Git option checks
• BZ - 2484204 - CVE-2026-42504 mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header
• BZ - 2488952 - CVE-2026-12405 rubygem-foreman_remote_execution: command injection in job invocations via effective_user parameter
• BZ - 2488956 - CVE-2026-12423 foreman: unauthenticated information disclosure via provisioning token validation flaw
• BZ - 2489969 - CVE-2026-12540 foreman: command injection in foreman-rake errors:fetch_log via request_id parameter
• BZ - 2489970 - CVE-2026-12541 foreman: command injection in foreman-rake database tasks
• BZ - 2489971 - CVE-2026-12542 foreman: command injection in foreman-tail
• BZ - 2489992 - CVE-2026-12544 foreman: SSTI and insecure deserialization in foreman-rake configuration
• BZ - 2489993 - CVE-2026-12545 rubygem-hammer_cli: command injection via insecure editor invocation
• BZ - 2490542 - CVE-2026-56098 rubygem-katello: improper authorization logic allows resource enumeration
• BZ - 2490543 - CVE-2026-56097 rubygem-katello: SQL injection in Registry Proxy via labels
• BZ - 2515243 - CVE-2026-73624 gitpython: GitPython: Arbitrary File Overwrite via improper git option validation
• BZ - 2515261 - CVE-2026-73620 gitpython: GitPython: Arbitrary file overwrite and read via unsafe git option forwarding
• BZ - 2515269 - CVE-2026-73622 gitpython: GitPython: Information disclosure via environment variable expansion in URL handling
• BZ - 2515272 - CVE-2026-73625 gitpython: GitPython: Remote Code Execution via kwarg value smuggling
• BZ - 2515275 - CVE-2026-73623 gitpython: GitPython: Remote Code Execution via malicious Git template
• BZ - 2515815 - CVE-2026-33818 encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal
• BZ - 2515820 - CVE-2026-56860 net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
• BZ - 2515827 - CVE-2026-56853 net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
• BZ - 2515838 - CVE-2026-56858 html/template: golang: Go html/template: Cross-Site Scripting via pathological input
• BZ - 2515839 - CVE-2026-56862 crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages
• BZ - 2517518 - CVE-2026-71491 sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in comment grouping
• BZ - 2517523 - CVE-2026-59893 sqlparse: sqlparse: Denial of Service via inefficient SQL parsing
• BZ - 2517527 - CVE-2026-54284 sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in SQL parsing
• BZ - 2520368 - CVE-2026-49825 lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href
• BZ - 2523205 - CVE-2026-78679 GitPython: GitPython: Arbitrary file read via TagReference.create()
• BZ - 2523348 - CVE-2026-79654 katello: Katello Content View History API Cross-Organization Authorization Bypass
• BZ - 2530744 - CVE-2026-87817 GitPython: GitPython: Remote Code Execution via Git directory impersonation
• BZ - 2534185 - CVE-2026-96658 foreman: Safemode Bypass leading to RCE
• BZ - 2536844 - CVE-2026-96659 foreman: Excessive Permissions for Viewer Role on Preview
• SAT-50544 - PG::InternalError: ERROR: invalid memory alloc request size 1714242091 when using "Host - Available Errata" report template [rhn_satellite_6.17]
• SAT-50545 - Issue encountered when using the parent_hostgroup parameter with the ^ operator [rhn_satellite_6.17]

CVEs

• CVE-2026-12405
• CVE-2026-12423
• CVE-2026-12540
• CVE-2026-12541
• CVE-2026-12542
• CVE-2026-12544
• CVE-2026-12545
• CVE-2026-33154
• CVE-2026-33818
• CVE-2026-42215
• CVE-2026-42284
• CVE-2026-42504
• CVE-2026-49825
• CVE-2026-54284
• CVE-2026-56097
• CVE-2026-56098
• CVE-2026-56853
• CVE-2026-56858
• CVE-2026-56860
• CVE-2026-56862
• CVE-2026-59893
• CVE-2026-71491
• CVE-2026-73620
• CVE-2026-73622
• CVE-2026-73623
• CVE-2026-73624
• CVE-2026-73625
• CVE-2026-78679
• CVE-2026-79654
• CVE-2026-87817
• CVE-2026-96658
• CVE-2026-96659

References

• https://access.redhat.com/security/updates/classification/#critical