{
  "document" : {
    "aggregate_severity" : {
      "namespace" : "https://access.redhat.com/security/updates/classification/",
      "text" : "Important"
    },
    "category" : "csaf_security_advisory",
    "csaf_version" : "2.0",
    "distribution" : {
      "text" : "Copyright © Red Hat, Inc. All rights reserved.",
      "tlp" : {
        "label" : "WHITE",
        "url" : "https://www.first.org/tlp/"
      }
    },
    "lang" : "en",
    "notes" : [ {
      "category" : "summary",
      "text" : "A new satellite/iop-advisor-backend-rhel9 container image is now generally available in the Red Hat container registry.",
      "title" : "Topic"
    }, {
      "category" : "general",
      "text" : "Red Hat Lightspeed in Satellite analyzes system health and configuration by applying  predefined rules to a small set of local data, such as installed packages,  running services, and configuration settings.  When you install Red Hat Lightspeed in Satellite locally,  you can generate Red Hat Lightspeed recommendations without  sending system data to Red Hat services. ",
      "title" : "Details"
    }, {
      "category" : "legal_disclaimer",
      "text" : "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
      "title" : "Terms of Use"
    } ],
    "publisher" : {
      "category" : "vendor",
      "contact_details" : "https://access.redhat.com/security/team/contact/",
      "issuing_authority" : "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name" : "Red Hat Product Security",
      "namespace" : "https://www.redhat.com"
    },
    "references" : [ {
      "category" : "self",
      "summary" : "https://access.redhat.com/errata/RHSA-2026:92595",
      "url" : "https://access.redhat.com/errata/RHSA-2026:92595"
    }, {
      "category" : "external",
      "summary" : "https://access.redhat.com/documentation/en-us/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
      "url" : "https://access.redhat.com/documentation/en-us/red_hat_satellite/6.19/html/updating_red_hat_satellite/index"
    }, {
      "category" : "external",
      "summary" : "https://access.redhat.com/security/cve/CVE-2026-84782",
      "url" : "https://access.redhat.com/security/cve/CVE-2026-84782"
    }, {
      "category" : "external",
      "summary" : "https://access.redhat.com/security/cve/CVE-2026-93599",
      "url" : "https://access.redhat.com/security/cve/CVE-2026-93599"
    }, {
      "category" : "external",
      "summary" : "https://access.redhat.com/security/updates/classification/",
      "url" : "https://access.redhat.com/security/updates/classification/"
    }, {
      "category" : "external",
      "summary" : "https://catalog.redhat.com/software/containers/search",
      "url" : "https://catalog.redhat.com/software/containers/search"
    }, {
      "category" : "external",
      "summary" : "https://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/installing_satellite_server_in_a_connected_network_environment/performing-additional-configuration-on-server_satellite#installing-and-configuring-red-hat-lightspeed-in-satellite",
      "url" : "https://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/installing_satellite_server_in_a_connected_network_environment/performing-additional-configuration-on-server_satellite#installing-and-configuring-red-hat-lightspeed-in-satellite"
    }, {
      "category" : "external",
      "summary" : "https://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/installing_satellite_server_in_a_disconnected_network_environment/performing-additional-configuration#installing-and-configuring-red-hat-lightspeed-in-satellite",
      "url" : "https://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/installing_satellite_server_in_a_disconnected_network_environment/performing-additional-configuration#installing-and-configuring-red-hat-lightspeed-in-satellite"
    }, {
      "category" : "self",
      "summary" : "Canonical URL",
      "url" : "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_92595.json"
    } ],
    "title" : "Red Hat Security Advisory: General availability of the satellite/iop-advisor-backend-rhel9 container image",
    "tracking" : {
      "current_release_date" : "2026-11-09T16:42:07+00:00",
      "generator" : {
        "date" : "2026-11-09T16:42:07+00:00",
        "engine" : {
          "name" : "Red Hat SDEngine",
          "version" : "5.4.5"
        }
      },
      "id" : "RHSA-2026:92595",
      "initial_release_date" : "2026-10-29T17:00:27+00:00",
      "revision_history" : [ {
        "date" : "2026-10-29T17:00:27+00:00",
        "number" : "1",
        "summary" : "Initial version"
      }, {
        "date" : "2026-10-29T17:00:34+00:00",
        "number" : "2",
        "summary" : "Last updated version"
      }, {
        "date" : "2026-11-09T16:42:07+00:00",
        "number" : "3",
        "summary" : "Last generated version"
      } ],
      "status" : "final",
      "version" : "3"
    }
  },
  "product_tree" : {
    "branches" : [ {
      "branches" : [ {
        "branches" : [ {
          "category" : "product_name",
          "name" : "Red Hat Satellite 6.19",
          "product" : {
            "name" : "Red Hat Satellite 6.19",
            "product_id" : "Red Hat Satellite 6.19",
            "product_identification_helper" : {
              "cpe" : "cpe:/a:redhat:satellite:6.19::el9"
            }
          }
        } ],
        "category" : "product_family",
        "name" : "Red Hat Satellite"
      }, {
        "branches" : [ {
          "category" : "product_version",
          "name" : "registry.redhat.io/satellite/iop-advisor-backend-rhel9@sha256:ee56a3e846d7446dbd3c3e8d5b15ecfddd037c106d5dd5f0469ae15272a73bdd_amd64",
          "product" : {
            "name" : "registry.redhat.io/satellite/iop-advisor-backend-rhel9@sha256:ee56a3e846d7446dbd3c3e8d5b15ecfddd037c106d5dd5f0469ae15272a73bdd_amd64",
            "product_id" : "registry.redhat.io/satellite/iop-advisor-backend-rhel9@sha256:ee56a3e846d7446dbd3c3e8d5b15ecfddd037c106d5dd5f0469ae15272a73bdd_amd64",
            "product_identification_helper" : {
              "purl" : "pkg:oci/iop-advisor-backend-rhel9@sha256%3Aee56a3e846d7446dbd3c3e8d5b15ecfddd037c106d5dd5f0469ae15272a73bdd?arch=amd64&repository_url=registry.redhat.io/satellite/iop-advisor-backend-rhel9&tag=1793175529"
            }
          }
        } ],
        "category" : "architecture",
        "name" : "amd64"
      } ],
      "category" : "vendor",
      "name" : "Red Hat"
    } ],
    "relationships" : [ {
      "category" : "default_component_of",
      "full_product_name" : {
        "name" : "registry.redhat.io/satellite/iop-advisor-backend-rhel9@sha256:ee56a3e846d7446dbd3c3e8d5b15ecfddd037c106d5dd5f0469ae15272a73bdd_amd64 as a component of Red Hat Satellite 6.19",
        "product_id" : "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-advisor-backend-rhel9@sha256:ee56a3e846d7446dbd3c3e8d5b15ecfddd037c106d5dd5f0469ae15272a73bdd_amd64"
      },
      "product_reference" : "registry.redhat.io/satellite/iop-advisor-backend-rhel9@sha256:ee56a3e846d7446dbd3c3e8d5b15ecfddd037c106d5dd5f0469ae15272a73bdd_amd64",
      "relates_to_product_reference" : "Red Hat Satellite 6.19"
    } ]
  },
  "vulnerabilities" : [ {
    "cve" : "CVE-2026-84782",
    "cwe" : {
      "id" : "CWE-125",
      "name" : "Out-of-bounds Read"
    },
    "discovery_date" : "2026-09-18T19:58:21.939000+00:00",
    "ids" : [ {
      "system_name" : "Red Hat Bugzilla ID",
      "text" : "2537080"
    } ],
    "notes" : [ {
      "category" : "description",
      "text" : "A flaw was found in OpenSSL. The Datagram Transport Layer Security (DTLS) retransmission mechanism fails to properly handle handshake message writes that are suspended before completion. A remote attacker could exploit this vulnerability during handshake message retransmission, causing OpenSSL to read past the message buffer or overwrite internal state required to resume writing. This issue can result in information disclosure through out-of-bounds memory reads or cause a Denial of Service (DoS) by crashing the process.",
      "title" : "Vulnerability description"
    }, {
      "category" : "summary",
      "text" : "openssl: compat-openssl: openssl: Information disclosure via DTLS handshake retransmission",
      "title" : "Vulnerability summary"
    }, {
      "category" : "other",
      "text" : "This vulnerability is rated as an Important severity because an unauthenticated network adversary can trigger process crashes or memory exposure without requiring local system privileges. Red Hat Enterprise Linux utilizes OpenSSL as the fundamental cryptographic provider across the operating system; however, overall exposure is limited because the flaw strictly affects software using Datagram Transport Layer Security (DTLS) over UDP under non-blocking I/O configurations. Standard TLS connections over TCP, which represent the typical deployment model for the majority of Red Hat workloads and system services, are unaffected.",
      "title" : "Statement"
    }, {
      "category" : "general",
      "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
      "title" : "CVSS score applicability"
    } ],
    "product_status" : {
      "fixed" : [ "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-advisor-backend-rhel9@sha256:ee56a3e846d7446dbd3c3e8d5b15ecfddd037c106d5dd5f0469ae15272a73bdd_amd64" ]
    },
    "references" : [ {
      "category" : "self",
      "summary" : "Canonical URL",
      "url" : "https://access.redhat.com/security/cve/CVE-2026-84782"
    }, {
      "category" : "external",
      "summary" : "RHBZ#2537080",
      "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2537080"
    }, {
      "category" : "external",
      "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-84782",
      "url" : "https://www.cve.org/CVERecord?id=CVE-2026-84782"
    }, {
      "category" : "external",
      "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-84782",
      "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-84782"
    }, {
      "category" : "external",
      "summary" : "https://openssl-library.org/news/vulnerabilities/#CVE-2026-84782",
      "url" : "https://openssl-library.org/news/vulnerabilities/#CVE-2026-84782"
    } ],
    "release_date" : "2026-09-29T00:00:00+00:00",
    "remediations" : [ {
      "category" : "vendor_fix",
      "date" : "2026-10-29T17:00:27+00:00",
      "details" : "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
      "product_ids" : [ "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-advisor-backend-rhel9@sha256:ee56a3e846d7446dbd3c3e8d5b15ecfddd037c106d5dd5f0469ae15272a73bdd_amd64" ],
      "restart_required" : {
        "category" : "none"
      },
      "url" : "https://access.redhat.com/errata/RHSA-2026:92595"
    } ],
    "scores" : [ {
      "cvss_v3" : {
        "attackComplexity" : "HIGH",
        "attackVector" : "NETWORK",
        "availabilityImpact" : "HIGH",
        "baseScore" : 7.4,
        "baseSeverity" : "HIGH",
        "confidentialityImpact" : "HIGH",
        "integrityImpact" : "NONE",
        "privilegesRequired" : "NONE",
        "scope" : "UNCHANGED",
        "userInteraction" : "NONE",
        "vectorString" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
        "version" : "3.1"
      },
      "products" : [ "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-advisor-backend-rhel9@sha256:ee56a3e846d7446dbd3c3e8d5b15ecfddd037c106d5dd5f0469ae15272a73bdd_amd64" ]
    } ],
    "threats" : [ {
      "category" : "impact",
      "details" : "Important"
    } ],
    "title" : "openssl: compat-openssl: openssl: Information disclosure via DTLS handshake retransmission"
  }, {
    "cve" : "CVE-2026-93599",
    "cwe" : {
      "id" : "CWE-125",
      "name" : "Out-of-bounds Read"
    },
    "discovery_date" : "2026-09-22T18:32:06.471964+00:00",
    "ids" : [ {
      "system_name" : "Red Hat Bugzilla ID",
      "text" : "2538431"
    } ],
    "notes" : [ {
      "category" : "description",
      "text" : "A flaw was found in rustls-webpki. A remote attacker, by influencing an application to parse a specially crafted Certificate Revocation List (CRL) that contains an empty `onlySomeReasons` value in its `issuingDistributionPoint` extension, could trigger a panic. This vulnerability leads to a denial of service (DoS) in applications that explicitly enable CRL revocation checking.",
      "title" : "Vulnerability description"
    }, {
      "category" : "summary",
      "text" : "rustls-webpki: rustls-webpki: Denial of Service via crafted Certificate Revocation List",
      "title" : "Vulnerability summary"
    }, {
      "category" : "other",
      "text" : "This vulnerability is rated as Important because an unauthenticated remote attacker can cause an immediate denial of service by triggering an unhandled panic in network-facing services. Exploitation requires the consuming software to explicitly enable Certificate Revocation List (CRL) validation, a capability that is disabled by default in standard rustls configurations. Applications and services that actively ingest revocation lists from untrusted endpoints face service termination, whereas environments utilizing default certificate verification workflows remain unaffected.",
      "title" : "Statement"
    }, {
      "category" : "general",
      "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
      "title" : "CVSS score applicability"
    } ],
    "product_status" : {
      "fixed" : [ "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-advisor-backend-rhel9@sha256:ee56a3e846d7446dbd3c3e8d5b15ecfddd037c106d5dd5f0469ae15272a73bdd_amd64" ]
    },
    "references" : [ {
      "category" : "self",
      "summary" : "Canonical URL",
      "url" : "https://access.redhat.com/security/cve/CVE-2026-93599"
    }, {
      "category" : "external",
      "summary" : "RHBZ#2538431",
      "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2538431"
    }, {
      "category" : "external",
      "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-93599",
      "url" : "https://www.cve.org/CVERecord?id=CVE-2026-93599"
    }, {
      "category" : "external",
      "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-93599",
      "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-93599"
    }, {
      "category" : "external",
      "summary" : "https://github.com/rustls/webpki/security/advisories/GHSA-82j2-j2ch-gfr8",
      "url" : "https://github.com/rustls/webpki/security/advisories/GHSA-82j2-j2ch-gfr8"
    }, {
      "category" : "external",
      "summary" : "https://www.vulncheck.com/advisories/rustls-webpki-before-0.103.13-panic-via-empty-bit-string",
      "url" : "https://www.vulncheck.com/advisories/rustls-webpki-before-0.103.13-panic-via-empty-bit-string"
    } ],
    "release_date" : "2026-09-18T13:20:10.258000+00:00",
    "remediations" : [ {
      "category" : "vendor_fix",
      "date" : "2026-10-29T17:00:27+00:00",
      "details" : "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
      "product_ids" : [ "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-advisor-backend-rhel9@sha256:ee56a3e846d7446dbd3c3e8d5b15ecfddd037c106d5dd5f0469ae15272a73bdd_amd64" ],
      "restart_required" : {
        "category" : "none"
      },
      "url" : "https://access.redhat.com/errata/RHSA-2026:92595"
    } ],
    "scores" : [ {
      "cvss_v3" : {
        "attackComplexity" : "LOW",
        "attackVector" : "NETWORK",
        "availabilityImpact" : "HIGH",
        "baseScore" : 7.5,
        "baseSeverity" : "HIGH",
        "confidentialityImpact" : "NONE",
        "integrityImpact" : "NONE",
        "privilegesRequired" : "NONE",
        "scope" : "UNCHANGED",
        "userInteraction" : "NONE",
        "vectorString" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
        "version" : "3.1"
      },
      "products" : [ "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-advisor-backend-rhel9@sha256:ee56a3e846d7446dbd3c3e8d5b15ecfddd037c106d5dd5f0469ae15272a73bdd_amd64" ]
    } ],
    "threats" : [ {
      "category" : "impact",
      "details" : "Important"
    } ],
    "title" : "rustls-webpki: rustls-webpki: Denial of Service via crafted Certificate Revocation List"
  } ]
}