RHSA-2024:8906: Critical: Satellite 6.16.0 release

Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity to provide public Internet access to their servers or other client systems. It performs provisioning and configuration management of predefined standard operating environments.Security Fix(es): mosquitto: sending specific sequences of packets may trigger memory leak (CVE-2024-8376) micromatch: vulnerable to Regular Expression Denial of Service (CVE-2024-4067) urllib3: proxy-authorization request header is not stripped during cross-origin redirects (CVE-2024-37891) node-tar: denial of service while parsing a tar file due to lack of folders depth validation (CVE-2024-28863) python-django: Potential denial-of-service in django.utils.html.urlize() (CVE-2024-38875) python-django: Username enumeration through timing difference for users with unusable passwords (CVE-2024-39329) python-django: Potential directory-traversal in django.core.files.storage.Storage.save() (CVE-2024-39330) python-django: Potential denial-of-service in django.utils.translation.getsupportedlanguagevariant() (CVE-2024-39614) github.com/jaraco/zipp: Denial of Service (infinite loop) via crafted zip file in jaraco/zipp (CVE-2024-5569) puppet-foreman: An authentication bypass vulnerability exists in Foreman (CVE-2024-7012) python-django: Potential SQL injection in QuerySet.values() and valueslist() (CVE-2024-42005) grpc: client communicating with a HTTP/2 proxy can poison the HPACK table between the proxy and the backend (CVE-2024-7246) puppet-pulpcore: An authentication bypass vulnerability exists in pulpcore (CVE-2024-7923) foreman: Read-only access to entire DB from templates (CVE-2024-8553) Users of Red Hat Satellite are advised to upgrade to these updated packages, which fix these bugs.

— Red Hat