RHSA-2026:95657 - Security Advisory

Topic

A security update for Red Hat Satellite 6.18 is now available.

Red Hat Product Security has rated this update as having a security impact of
Important. A Common Vulnerability Scoring System (CVSS) base score, which gives
a detailed severity rating, is available for each vulnerability from the CVE
links in the References section.

Description

This advisory provides security fixes for affected packages used by Red Hat
Satellite. The updates address the vulnerabilities described below.

Security Fix(es):

• python3.12-django: Django: Remote code execution via GeoDjango spatial lookups (CVE-2026-15307)
• python3.12-brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)
• python3.12-urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override (CVE-2026-97687)
• python3.12-urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser (CVE-2026-97689)
• python3.12-pillow: pillow: Denial of Service via duplicate page references in PDF files (CVE-2026-96640)
• python3.12-pillow: pillow: Denial of Service via repeated EXIF headers (CVE-2026-96643)
• python3.12-pillow: pillow: Arbitrary code execution via JPEG encoder buffer overflow (CVE-2026-96778)
• python3.12-pillow: Pillow: Denial of Service via infinite loop during crafted MIC image parsing (CVE-2026-112390)
• python3.12-pillow: Pillow: Denial of Service via unbounded recursion in PDF parser (CVE-2026-112391)
• python3.12-pillow: pillow: Denial of Service via zero-size images in rank filters (CVE-2026-112392)
• python3.12-pillow: Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO (CVE-2026-112393)
• python3.12-pillow: pillow: Denial of Service via out-of-bounds memory access on zero-width images (CVE-2026-112397)
• python3.12-pillow: Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution (CVE-2026-112398)
• python3.12-pillow: pillow: Denial of service via crafted APNG image (CVE-2026-112399)
• python3.12-pillow: pillow: Denial of Service via memory exhaustion from crafted GIF image (CVE-2026-112400)
• python3.12-pillow: pillow: Denial of service via double free during image transformation (CVE-2026-112402)
• python3.12-pillow: Pillow: Heap buffer overflow in ImagingJpegDecode (CVE-2026-112403)
• python3.12-pillow: Pillow: Denial of Service via out-of-bounds read in TIFF decoding (CVE-2026-112404)
• python3.12-pillow: Pillow: Denial of Service via null pointer dereference in Image.merge() (CVE-2026-112405)
• python3.12-pillow: pillow: Denial of Service via infinite loop during PDF page rewriting (CVE-2026-112406)
• python3.12-pillow: pillow: Denial of Service via unbounded memory expansion in MSP image decoder (CVE-2026-112892)
• python3.12-pillow: Pillow: Denial of Service via invalid pointer free during font rendering (CVE-2026-112893)
• python3.12-pillow: pillow: Denial of Service via crafted multi-frame image conversion (CVE-2026-112894)
• python3.12-pillow: pillow: Denial of service via crafted PDF during append operations (CVE-2026-112895)
• python3.12-pillow: Pillow: Denial of Service via out-of-bounds read in TIFF encoder (CVE-2026-112896)
• python3.12-pillow: pillow: Information disclosure via uninitialized buffer in TIFF decoding (CVE-2026-112897)
• python-gitpython: GitPython: Arbitrary file read vulnerability via `Repo.archive()` (CVE-2026-73619)
• python3.12-gitpython: GitPython: Arbitrary Code Execution via Path Traversal (CVE-2026-78677)
• python3.12-gitpython: GitPython: Denial of Service via crafted commit author field (CVE-2026-87819)
• python3.12-gitpython: GitPython: Denial of Service via regular expression backtracking in date parsing (CVE-2026-110856)
• python3.12-gitpython: GitPython: Arbitrary code execution via unsafe URL protocol handling (CVE-2026-110857)
• python3.12-gitpython: GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() Refspec (CVE-2026-110858)
• python3.12-gitpython: GitPython: Arbitrary file read via argument injection in branch checkout (CVE-2026-110859)
• python3.12-gitpython: GitPython: arbitrary code execution via improper submodule path validation (CVE-2026-114145)
• openvox-agent: integer overflow issue in regular expression compiler (CVE-2026-110264)
• openvox-agent: integer overflow issue in CI/CD regular expression compiler (CVE-2026-97229)
• openvox-agent: integer overflow issue in regular expression compiler (CVE-2026-93577)
• openvox-agent: double free issue in regular expression parser (CVE-2026-89078)
• openvox-server: jackson-dataformat-smile: Denial of Service via unbounded memory allocation in asynchronous parser (CVE-2026-104895)

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Satellite 6.18 x86_64
• Red Hat Satellite Capsule 6.18 x86_64

Fixes

• BZ - 2511095 - CVE-2026-15307 django: Django: Remote code execution via GeoDjango spatial lookups
• BZ - 2515265 - CVE-2026-73619 gitpython: GitPython: Arbitrary file read vulnerability via `Repo.archive()`
• BZ - 2523215 - CVE-2026-78677 GitPython: GitPython: Arbitrary Code Execution via Path Traversal
• BZ - 2530742 - CVE-2026-87819 GitPython: GitPython: Denial of Service via crafted commit author field
• BZ - 2539836 - CVE-2026-89078 ruby: double free issue in regular expression parser
• BZ - 2539842 - CVE-2026-93577 ruby: integer overflow issue in regular expression compiler
• BZ - 2543245 - CVE-2026-97689 urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser
• BZ - 2543255 - CVE-2026-97687 urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override
• BZ - 2550153 - CVE-2026-97229 ruby: integer overflow issue in CI/CD regular expression compiler
• BZ - 2552959 - CVE-2026-110858 GitPython: GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() Refspec
• BZ - 2552966 - CVE-2026-110857 GitPython: GitPython: Arbitrary code execution via unsafe URL protocol handling
• BZ - 2552977 - CVE-2026-110856 GitPython: GitPython: Denial of Service via regular expression backtracking in date parsing
• BZ - 2552989 - CVE-2026-110859 GitPython: GitPython: Arbitrary file read via argument injection in branch checkout
• BZ - 2555846 - CVE-2026-112393 pillow: Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO
• BZ - 2555848 - CVE-2026-112390 pillow: Pillow: Denial of Service via infinite loop during crafted MIC image parsing
• BZ - 2555851 - CVE-2026-112391 pillow: Pillow: Denial of Service via unbounded recursion in PDF parser
• BZ - 2555859 - CVE-2026-112402 pillow: pillow: Denial of service via double free during image transformation
• BZ - 2555863 - CVE-2026-112399 pillow: pillow: Denial of service via crafted APNG image
• BZ - 2555864 - CVE-2026-112400 pillow: pillow: Denial of Service via memory exhaustion from crafted GIF image
• BZ - 2555866 - CVE-2026-112392 pillow: pillow: Denial of Service via zero-size images in rank filters
• BZ - 2555867 - CVE-2026-112398 pillow: Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution
• BZ - 2555868 - CVE-2026-112397 pillow: pillow: Denial of Service via out-of-bounds memory access on zero-width images
• BZ - 2555871 - CVE-2026-112403 pillow: Pillow: Heap buffer overflow in ImagingJpegDecode
• BZ - 2555873 - CVE-2026-112405 pillow: Pillow: Denial of Service via null pointer dereference in Image.merge()
• BZ - 2555874 - CVE-2026-112404 pillow: Pillow: Denial of Service via out-of-bounds read in TIFF decoding
• BZ - 2555875 - CVE-2026-112894 pillow: pillow: Denial of Service via crafted multi-frame image conversion
• BZ - 2555878 - CVE-2026-112893 pillow: Pillow: Denial of Service via invalid pointer free during font rendering
• BZ - 2555879 - CVE-2026-112895 pillow: pillow: Denial of service via crafted PDF during append operations
• BZ - 2555888 - CVE-2026-112897 pillow: pillow: Information disclosure via uninitialized buffer in TIFF decoding
• BZ - 2555890 - CVE-2026-112896 pillow: Pillow: Denial of Service via out-of-bounds read in TIFF encoder
• BZ - 2556322 - CVE-2026-112406 pillow: pillow: Denial of Service via infinite loop during PDF page rewriting
• BZ - 2558563 - CVE-2026-114145 GitPython: GitPython: arbitrary code execution via improper submodule path validation
• BZ - 2558566 - CVE-2026-96643 pillow: pillow: Denial of Service via repeated EXIF headers
• BZ - 2558567 - CVE-2026-96778 pillow: pillow: Arbitrary code execution via JPEG encoder buffer overflow
• BZ - 2558576 - CVE-2026-96640 pillow: pillow: Denial of Service via duplicate page references in PDF files
• BZ - 2558632 - CVE-2026-110264 ruby: integer overflow issue in regular expression compiler
• BZ - 2558973 - CVE-2026-111497 brotli: Out-of-Bounds Write in Google Brotli Decoder
• BZ - 2559393 - CVE-2026-112892 pillow: pillow: Denial of Service via unbounded memory expansion in MSP image decoder
• BZ - 2562517 - CVE-2026-104895 com.fasterxml.jackson.dataformat/jackson-dataformat-smile: jackson-dataformat-smile: Denial of Service via unbounded memory allocation in asynchronous parser

CVEs

• CVE-2026-15307
• CVE-2026-73619
• CVE-2026-78677
• CVE-2026-87819
• CVE-2026-89078
• CVE-2026-93577
• CVE-2026-96640
• CVE-2026-96643
• CVE-2026-96778
• CVE-2026-97229
• CVE-2026-97687
• CVE-2026-97689
• CVE-2026-104895
• CVE-2026-110264
• CVE-2026-110856
• CVE-2026-110857
• CVE-2026-110858
• CVE-2026-110859
• CVE-2026-111497
• CVE-2026-112390
• CVE-2026-112391
• CVE-2026-112392
• CVE-2026-112393
• CVE-2026-112397
• CVE-2026-112398
• CVE-2026-112399
• CVE-2026-112400
• CVE-2026-112402
• CVE-2026-112403
• CVE-2026-112404
• CVE-2026-112405
• CVE-2026-112406
• CVE-2026-112892
• CVE-2026-112893
• CVE-2026-112894
• CVE-2026-112895
• CVE-2026-112896
• CVE-2026-112897
• CVE-2026-114145

References

• https://access.redhat.com/security/updates/classification/#critical