RHSA-2026:95655 - Security Advisory

Topic

A security update for Red Hat Satellite is now available.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

Description

This advisory provides security fixes for affected packages used by Red Hat Satellite. The updates address the vulnerabilities described below.

Security Fix(es):

• python-django: Django: Remote code execution via GeoDjango spatial lookups (CVE-2026-15307)
• python-urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser (CVE-2026-97689)
• python-urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override (CVE-2026-97687)
• python-gitpython: GitPython: Arbitrary code execution via unsafe URL protocol handling (CVE-2026-110857)
• python-gitpython: GitPython: Arbitrary file read via argument injection in branch checkout (CVE-2026-110859)
• python-gitpython: GitPython: Denial of Service via regular expression backtracking in date parsing (CVE-2026-110856)
• python-gitpython: GitPython: Arbitrary file read vulnerability via `Repo.archive()` (CVE-2026-73619)
• satellite-capsule:el8/python-gitpython: GitPython: Arbitrary file read vulnerability via `Repo.archive()` (CVE-2026-73619)
• python-pillow: Pillow: Denial of Service via unbounded recursion in PDF parser (CVE-2026-112391)
• python-pillow: Pillow: Denial of Service via infinite loop during crafted MIC image parsing (CVE-2026-112390)
• python-pillow: Pillow: Denial of Service via null pointer dereference in Image.merge() (CVE-2026-112405)
• python-pillow: pillow: Denial of service via crafted APNG image (CVE-2026-112399)
• python-pillow: pillow: Denial of Service via zero-size images in rank filters (CVE-2026-112392)
• python-pillow: pillow: Denial of Service via out-of-bounds memory access on zero-width images (CVE-2026-112397)
• python-pillow: pillow: Denial of Service via memory exhaustion from crafted GIF image (CVE-2026-112400)
• python-pillow: pillow: Denial of Service via crafted multi-frame image conversion (CVE-2026-112894)
• python-pillow: pillow: Denial of service via crafted PDF during append operations (CVE-2026-112895)
• python-pillow: pillow: Denial of service via double free during image transformation (CVE-2026-112402)
• python-pillow: Pillow: Denial of Service via invalid pointer free during font rendering (CVE-2026-112893)
• python-pillow: pillow: Information disclosure via uninitialized buffer in TIFF decoding (CVE-2026-112897)
• python-pillow: Pillow: Denial of Service via out-of-bounds read in TIFF encoder (CVE-2026-112896)
• python-pillow: Pillow: Denial of Service via out-of-bounds read in TIFF decoding (CVE-2026-112404)
• python-gitpython: GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() Refspec (CVE-2026-110858)
• python-pillow: pillow: Denial of Service via infinite loop during PDF page rewriting (CVE-2026-112406)
• python-pillow: pillow: Arbitrary code execution via JPEG encoder buffer overflow (CVE-2026-96778)
• python-gitpython: GitPython: arbitrary code execution via improper submodule path validation (CVE-2026-114145)
• python-pillow: pillow: Denial of Service via duplicate page references in PDF files (CVE-2026-96640)
• python-pillow: pillow: Denial of Service via repeated EXIF headers (CVE-2026-96643)
• python-brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)
• python-pillow: pillow: Denial of Service via unbounded memory expansion in MSP image decoder (CVE-2026-112892)
• python-pillow: Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO (CVE-2026-112393)
• python-pillow: Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution (CVE-2026-112398)
• python-pillow: Pillow: Heap buffer overflow in ImagingJpegDecode (CVE-2026-112403)
• openvox-server: puppetserver: authenticated remote code execution via report event deserialization (CVE-2026-115731)
• puppetserver: puppetserver: authenticated remote code execution via report event deserialization (CVE-2026-115731)
• openvox-server: trapperkeeper-authorization: certificate name authorization bypass via flawed hostname ACL match (CVE-2026-115732)
• puppetserver: trapperkeeper-authorization: certificate name authorization bypass via flawed hostname ACL match (CVE-2026-115732)
• openvox-agent: integer overflow issue in regular expression compiler (CVE-2026-110264)
• openvox-agent: integer overflow issue in CI/CD regular expression compiler (CVE-2026-97229)
• openvox-agent: integer overflow issue in regular expression compiler (CVE-2026-93577)
• openvox-agent: double free issue in regular expression parser (CVE-2026-89078)
• openvox-server: jackson-dataformat-smile: Denial of Service via unbounded memory allocation in asynchronous parser (CVE-2026-104895)

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For detailed instructions how to apply this update, refer to:

https://docs.redhat.com/en/documentation/red_hat_satellite/6.16/html/updating_red_hat_satellite/index

Release Notes:

Provisioning tokens are now required for all Operating System entries with the Red Hat family set. Attempts to download an unattended template without a valid token will lead to “a provisioning token is required but a valid one was not provided” error.

This changed behavior will lead to inability to use Generic or Subnet Bootdisks, systems using this bootdiks will be not matched with the host entry and not boot. To use Bootdisk after applying the errata, either use Full Host Bootdisk, which uses tokens, or set Administer - Settings - Provisioning - Installation token lifetime to zero. This turns off the token enforcement and allows unauthenticated parties to use arbitrary MAC addresses in unattended requests to fetch provisioning kickstart with possibly sensitive data.

Affected Products

• Red Hat Satellite Extended Update Support 6.16 for RHEL 9 x86_64
• Red Hat Satellite Extended Update Support 6.16 for RHEL 8 x86_64
• Red Hat Satellite Capsule Extended Update Support 6.16 for RHEL 9 x86_64
• Red Hat Satellite Capsule Extended Update Support 6.16 for RHEL 8 x86_64

Fixes

• BZ - 2511095 - CVE-2026-15307 django: Django: Remote code execution via GeoDjango spatial lookups
• BZ - 2515265 - CVE-2026-73619 gitpython: GitPython: Arbitrary file read vulnerability via `Repo.archive()`
• BZ - 2539836 - CVE-2026-89078 ruby: double free issue in regular expression parser
• BZ - 2539842 - CVE-2026-93577 ruby: integer overflow issue in regular expression compiler
• BZ - 2543245 - CVE-2026-97689 urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser
• BZ - 2543255 - CVE-2026-97687 urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override
• BZ - 2550153 - CVE-2026-97229 ruby: integer overflow issue in CI/CD regular expression compiler
• BZ - 2552959 - CVE-2026-110858 GitPython: GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() Refspec
• BZ - 2552966 - CVE-2026-110857 GitPython: GitPython: Arbitrary code execution via unsafe URL protocol handling
• BZ - 2552977 - CVE-2026-110856 GitPython: GitPython: Denial of Service via regular expression backtracking in date parsing
• BZ - 2552989 - CVE-2026-110859 GitPython: GitPython: Arbitrary file read via argument injection in branch checkout
• BZ - 2555846 - CVE-2026-112393 pillow: Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO
• BZ - 2555848 - CVE-2026-112390 pillow: Pillow: Denial of Service via infinite loop during crafted MIC image parsing
• BZ - 2555851 - CVE-2026-112391 pillow: Pillow: Denial of Service via unbounded recursion in PDF parser
• BZ - 2555859 - CVE-2026-112402 pillow: pillow: Denial of service via double free during image transformation
• BZ - 2555863 - CVE-2026-112399 pillow: pillow: Denial of service via crafted APNG image
• BZ - 2555864 - CVE-2026-112400 pillow: pillow: Denial of Service via memory exhaustion from crafted GIF image
• BZ - 2555866 - CVE-2026-112392 pillow: pillow: Denial of Service via zero-size images in rank filters
• BZ - 2555867 - CVE-2026-112398 pillow: Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution
• BZ - 2555868 - CVE-2026-112397 pillow: pillow: Denial of Service via out-of-bounds memory access on zero-width images
• BZ - 2555871 - CVE-2026-112403 pillow: Pillow: Heap buffer overflow in ImagingJpegDecode
• BZ - 2555873 - CVE-2026-112405 pillow: Pillow: Denial of Service via null pointer dereference in Image.merge()
• BZ - 2555874 - CVE-2026-112404 pillow: Pillow: Denial of Service via out-of-bounds read in TIFF decoding
• BZ - 2555875 - CVE-2026-112894 pillow: pillow: Denial of Service via crafted multi-frame image conversion
• BZ - 2555878 - CVE-2026-112893 pillow: Pillow: Denial of Service via invalid pointer free during font rendering
• BZ - 2555879 - CVE-2026-112895 pillow: pillow: Denial of service via crafted PDF during append operations
• BZ - 2555888 - CVE-2026-112897 pillow: pillow: Information disclosure via uninitialized buffer in TIFF decoding
• BZ - 2555890 - CVE-2026-112896 pillow: Pillow: Denial of Service via out-of-bounds read in TIFF encoder
• BZ - 2556322 - CVE-2026-112406 pillow: pillow: Denial of Service via infinite loop during PDF page rewriting
• BZ - 2558563 - CVE-2026-114145 GitPython: GitPython: arbitrary code execution via improper submodule path validation
• BZ - 2558566 - CVE-2026-96643 pillow: pillow: Denial of Service via repeated EXIF headers
• BZ - 2558567 - CVE-2026-96778 pillow: pillow: Arbitrary code execution via JPEG encoder buffer overflow
• BZ - 2558576 - CVE-2026-96640 pillow: pillow: Denial of Service via duplicate page references in PDF files
• BZ - 2558632 - CVE-2026-110264 ruby: integer overflow issue in regular expression compiler
• BZ - 2558973 - CVE-2026-111497 brotli: Out-of-Bounds Write in Google Brotli Decoder
• BZ - 2559393 - CVE-2026-112892 pillow: pillow: Denial of Service via unbounded memory expansion in MSP image decoder
• BZ - 2562517 - CVE-2026-104895 com.fasterxml.jackson.dataformat/jackson-dataformat-smile: jackson-dataformat-smile: Denial of Service via unbounded memory allocation in asynchronous parser
• BZ - 2566291 - CVE-2026-115732 trapperkeeper-authorization: puppetserver: openvox-server: openvoxdb: trapperkeeper-authorization: certificate name authorization bypass via flawed hostname ACL match
• BZ - 2566451 - CVE-2026-115731 puppetserver: openvox-agent: openvox-server: puppetserver: authenticated remote code execution via report event deserialization

CVEs

• CVE-2026-15307
• CVE-2026-73619
• CVE-2026-89078
• CVE-2026-93577
• CVE-2026-96640
• CVE-2026-96643
• CVE-2026-96778
• CVE-2026-97229
• CVE-2026-97687
• CVE-2026-97689
• CVE-2026-104895
• CVE-2026-110264
• CVE-2026-110856
• CVE-2026-110857
• CVE-2026-110858
• CVE-2026-110859
• CVE-2026-111497
• CVE-2026-112390
• CVE-2026-112391
• CVE-2026-112392
• CVE-2026-112393
• CVE-2026-112397
• CVE-2026-112398
• CVE-2026-112399
• CVE-2026-112400
• CVE-2026-112402
• CVE-2026-112403
• CVE-2026-112404
• CVE-2026-112405
• CVE-2026-112406
• CVE-2026-112892
• CVE-2026-112893
• CVE-2026-112894
• CVE-2026-112895
• CVE-2026-112896
• CVE-2026-112897
• CVE-2026-114145
• CVE-2026-115731
• CVE-2026-115732

References

• https://access.redhat.com/security/updates/classification/#critical