Protect yourself against future threats.
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2024.1822
Satellite 6.14.3 Async Security Update
28 March 2024
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Red Hat Satellite 6.14
Publisher: Red Hat
Operating System: Red Hat
Resolution: Patch/Upgrade
CVE Names: CVE-2023-43665 CVE-2023-47627 CVE-2024-23334
CVE-2024-23829 CVE-2024-22195 CVE-2023-5189
CVE-2023-49081
Original Bulletin:
https://access.redhat.com/errata/RHSA-2024:1536
Comment: CVSS (Max): 7.5 CVE-2023-47627 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
CVSS Source: Red Hat
Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- --------------------------BEGIN INCLUDED TEXT--------------------
=====================================================================
Red Hat Security Advisory
Synopsis: Moderate: Satellite 6.14.3 Async Security Update
Advisory ID: RHSA-2024:1536
Product: Red Hat Satellite 6.14 for RHEL 8
Advisory URL: https://access.redhat.com/errata/RHSA-2024:1536
Issue date: 2024-03-27
CVE Names: CVE-2023-5189 CVE-2023-43665 CVE-2023-47627 CVE-2023-49081
CVE-2024-22195 CVE-2024-23334 CVE-2024-23829
=====================================================================
1. Summary:
An update is now available for Red Hat Satellite 6.14 for RHEL 8.
Red Hat Product Security has rated this update as having a security impact
of
Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a
detailed severity rating, is available for each vulnerability from the CVE
link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Satellite 6.14 for RHEL 8 - noarch, x86_64
Red Hat Satellite 6.14 for RHEL 8 - noarch, x86_64
Red Hat Satellite 6.14 for RHEL 8 - noarch, x86_64
3. Description:
Red Hat Satellite is a system management solution that allows organizations
to configure and maintain their systems without the necessity to provide
public Internet access to their servers or other client systems. It
performs provisioning and configuration management of predefined standard
operating environments.
Security Fix(es):
* automation-hub: Ansible Automation Hub: insecure galaxy-importer tarfile
extraction (CVE-2023-5189)
* python-aiohttp: aiohttp: follow_symlinks directory traversal vulnerability
(CVE-2024-23334)
* python-aiohttp: http request smuggling (CVE-2024-23829)
* python-aiohttp: numerous issues in HTTP parser with header parsing
(CVE-2023-47627)
* python-aiohttp: aiohttp: HTTP request modification (CVE-2023-49081)
* python-django: Denial-of-service possibility in django.utils.text.Truncator
(CVE-2023-43665)
* python-jinja2: jinja2: HTML attribute injection when passing user input as
keys to xmlattr filter (CVE-2024-22195)
Bug Fix(es):
2266107 - hammer host list does not print parameters even if they are present in
the fields list like LCE and CVs.
2266110 - Incremental update of *multiple* CVs with same repo of different
content generates wrong katello content
2266139 - Failed incremental CV import shows error: duplicate key value violates
unique constraint "rpm_updatecollectionname_name_update_record_id_6ef33bed_uniq"
2266140 - wrong links to provisioning guide in CR help
2266142 - When using the customer data (json) with 13 diff conf files, we can
see some weird behavior when updating the hypervisors
2266144 - Promoting a composite content view to environment with registry name
as "<%= lifecycle_environment.label %>/<%= repository.name %>" on Red Hat
Satellite 6 fails with "'undefined method '#label' for NilClass::Jail
(NilClass)'"
2266145 - CertificateCleanupJob fails with foreign key constraint violation on
table cp_certificate
2266146 - katello:reimport fails with "TypeError: no implicit conversion of
String into Integer" when there are product contents to move
2266147 - Postgresql logs contain PG::UniqueViolation: ERROR: duplicate key
value violates unique constraint
"katello_available_module_streams_name_stream_context"
2266148 - Adding a CV to a CCV lists CV versions disorderly
2266149 - 'Remove orphans' task fails on DeleteOrphanAlternateContentSources
step
2266413 - [RFE] "Add content view" window and "Update version" window should
display content view version, description and publishing date
2266113 - [RFE] To make customers aware about satellite versions going EOL by
adding warning banner on the Login page or on the Dashboard page.
2266141 - wrong link to scap content documentation
Users of Red Hat Satellite are advised to upgrade to these updated
packages, which fix these bugs.
4. Solution:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
For detailed instructions how to apply this update, refer to:
https://access.redhat.com/documentation/en-
us/red_hat_satellite/6.14/html/upgrading_and_updating_red_hat_satellite/index
5. Bugs fixed (https://bugzilla.redhat.com/):
2234387 - CVE-2023-5189 - Ansible Automation Hub: insecure galaxy-importer
tarfile extraction
2241046 - CVE-2023-43665 - python-django: Denial-of-service possibility in
django.utils.text.Truncator
2249825 - CVE-2023-47627 - python-aiohttp: numerous issues in HTTP parser with
header parsing
2252235 - CVE-2023-49081 - aiohttp: HTTP request modification
2257854 - CVE-2024-22195 - jinja2: HTML attribute injection when passing user
input as keys to xmlattr filter
2261887 - CVE-2024-23334 - aiohttp: follow_symlinks directory traversal
vulnerability
2261909 - CVE-2024-23829 - python-aiohttp: http request smuggling
6. Package List:
Red Hat Satellite 6.14 for RHEL 8
Source:
8Base-satellite-6.14-capsule:python-galaxy-importer-0:0.4.18-2.el8pc.src.rpm
python-galaxy-importer-0:0.4.18-2.el8pc.src.rpm
8Base-satellite-6.14-capsule:python-aiohttp-0:3.9.2-0.1.el8pc.src.rpm
8Base-satellite-6.14-capsule:python-ansible-builder-0:1.2.0-1.el8pc.src.rpm
8Base-satellite-6.14-capsule:python-async-timeout-0:4.0.3-0.1.el8pc.src.rpm
8Base-satellite-6.14-capsule:python-django-0:3.2.22-1.el8pc.src.rpm
8Base-satellite-6.14-capsule:python-flake8-0:5.0.0-0.1.el8pc.src.rpm
8Base-satellite-6.14-capsule:python-jinja2-0:3.1.3-0.1.el8pc.src.rpm
8Base-satellite-6.14-capsule:python-mccabe-0:0.7.0-0.1.el8pc.src.rpm
8Base-satellite-6.14-capsule:python-pulp-rpm-0:3.19.12-1.el8pc.src.rpm
8Base-satellite-6.14-capsule:python-pulpcore-0:3.22.22-2.el8pc.src.rpm
8Base-satellite-6.14-capsule:python-pycodestyle-0:2.9.1-0.1.el8pc.src.rpm
8Base-satellite-6.14-capsule:python-pyflakes-0:2.5.0-0.1.el8pc.src.rpm
8Base-satellite-6.14-capsule:satellite-0:6.14.3-1.el8sat.src.rpm
8Base-satellite-6.14-utils:rubygem-hammer_cli_katello-0:1.9.1.3-1.el8sat.src.rpm
8Base-satellite-6.14-utils:satellite-0:6.14.3-1.el8sat.src.rpm
candlepin-0:4.3.12-1.el8sat.src.rpm
python-aiohttp-0:3.9.2-0.1.el8pc.src.rpm
python-ansible-builder-0:1.2.0-1.el8pc.src.rpm
python-async-timeout-0:4.0.3-0.1.el8pc.src.rpm
python-django-0:3.2.22-1.el8pc.src.rpm
python-flake8-0:5.0.0-0.1.el8pc.src.rpm
python-jinja2-0:3.1.3-0.1.el8pc.src.rpm
python-mccabe-0:0.7.0-0.1.el8pc.src.rpm
python-pulp-rpm-0:3.19.12-1.el8pc.src.rpm
python-pulpcore-0:3.22.22-2.el8pc.src.rpm
python-pycodestyle-0:2.9.1-0.1.el8pc.src.rpm
python-pyflakes-0:2.5.0-0.1.el8pc.src.rpm
rubygem-foreman_theme_satellite-0:12.0.0.8-1.el8sat.src.rpm
rubygem-foreman_virt_who_configure-0:0.5.19-1.el8sat.src.rpm
rubygem-hammer_cli_katello-0:1.9.1.3-1.el8sat.src.rpm
rubygem-katello-0:4.9.0.23-1.el8sat.src.rpm
satellite-0:6.14.3-1.el8sat.src.rpm
satellite-lifecycle-0:0.0.0.1-1.src.rpm
noarch:
8Base-satellite-6.14-capsule:python39-galaxy-
importer-0:0.4.18-2.el8pc.noarch.rpm
python39-galaxy-importer-0:0.4.18-2.el8pc.noarch.rpm
8Base-satellite-6.14-capsule:python39-ansible-builder-0:1.2.0-1.el8pc.noarch.rpm
8Base-satellite-6.14-capsule:python39-async-timeout-0:4.0.3-0.1.el8pc.noarch.rpm
8Base-satellite-6.14-capsule:python39-django-0:3.2.22-1.el8pc.noarch.rpm
8Base-satellite-6.14-capsule:python39-flake8-0:5.0.0-0.1.el8pc.noarch.rpm
8Base-satellite-6.14-capsule:python39-jinja2-0:3.1.3-0.1.el8pc.noarch.rpm
8Base-satellite-6.14-capsule:python39-mccabe-0:0.7.0-0.1.el8pc.noarch.rpm
8Base-satellite-6.14-capsule:python39-pulp-rpm-0:3.19.12-1.el8pc.noarch.rpm
8Base-satellite-6.14-capsule:python39-pulpcore-0:3.22.22-2.el8pc.noarch.rpm
8Base-satellite-6.14-capsule:python39-pycodestyle-0:2.9.1-0.1.el8pc.noarch.rpm
8Base-satellite-6.14-capsule:python39-pyflakes-0:2.5.0-0.1.el8pc.noarch.rpm
8Base-satellite-6.14-capsule:satellite-0:6.14.3-1.el8sat.noarch.rpm
8Base-satellite-6.14-capsule:satellite-capsule-0:6.14.3-1.el8sat.noarch.rpm
8Base-satellite-6.14-capsule:satellite-cli-0:6.14.3-1.el8sat.noarch.rpm
8Base-satellite-6.14-capsule:satellite-common-0:6.14.3-1.el8sat.noarch.rpm
8Base-satellite-6.14-utils:rubygem-
hammer_cli_katello-0:1.9.1.3-1.el8sat.noarch.rpm
8Base-satellite-6.14-utils:satellite-0:6.14.3-1.el8sat.noarch.rpm
8Base-satellite-6.14-utils:satellite-capsule-0:6.14.3-1.el8sat.noarch.rpm
8Base-satellite-6.14-utils:satellite-cli-0:6.14.3-1.el8sat.noarch.rpm
8Base-satellite-6.14-utils:satellite-common-0:6.14.3-1.el8sat.noarch.rpm
candlepin-0:4.3.12-1.el8sat.noarch.rpm
candlepin-selinux-0:4.3.12-1.el8sat.noarch.rpm
python39-ansible-builder-0:1.2.0-1.el8pc.noarch.rpm
python39-async-timeout-0:4.0.3-0.1.el8pc.noarch.rpm
python39-django-0:3.2.22-1.el8pc.noarch.rpm
python39-flake8-0:5.0.0-0.1.el8pc.noarch.rpm
python39-jinja2-0:3.1.3-0.1.el8pc.noarch.rpm
python39-mccabe-0:0.7.0-0.1.el8pc.noarch.rpm
python39-pulp-rpm-0:3.19.12-1.el8pc.noarch.rpm
python39-pulpcore-0:3.22.22-2.el8pc.noarch.rpm
python39-pycodestyle-0:2.9.1-0.1.el8pc.noarch.rpm
python39-pyflakes-0:2.5.0-0.1.el8pc.noarch.rpm
rubygem-foreman_theme_satellite-0:12.0.0.8-1.el8sat.noarch.rpm
rubygem-foreman_virt_who_configure-0:0.5.19-1.el8sat.noarch.rpm
rubygem-hammer_cli_katello-0:1.9.1.3-1.el8sat.noarch.rpm
rubygem-katello-0:4.9.0.23-1.el8sat.noarch.rpm
satellite-0:6.14.3-1.el8sat.noarch.rpm
satellite-capsule-0:6.14.3-1.el8sat.noarch.rpm
satellite-cli-0:6.14.3-1.el8sat.noarch.rpm
satellite-common-0:6.14.3-1.el8sat.noarch.rpm
satellite-lifecycle-0:0.0.0.1-1.noarch.rpm
x86_64:
8Base-satellite-6.14-capsule:python-aiohttp-
debugsource-0:3.9.2-0.1.el8pc.x86_64.rpm
8Base-satellite-6.14-capsule:python39-aiohttp-0:3.9.2-0.1.el8pc.x86_64.rpm
8Base-satellite-6.14-capsule:python39-aiohttp-
debuginfo-0:3.9.2-0.1.el8pc.x86_64.rpm
python-aiohttp-debugsource-0:3.9.2-0.1.el8pc.x86_64.rpm
python39-aiohttp-0:3.9.2-0.1.el8pc.x86_64.rpm
python39-aiohttp-debuginfo-0:3.9.2-0.1.el8pc.x86_64.rpm
Red Hat Satellite 6.14 for RHEL 8
Source:
python-galaxy-importer-0:0.4.18-2.el8pc.src.rpm
python-aiohttp-0:3.9.2-0.1.el8pc.src.rpm
python-ansible-builder-0:1.2.0-1.el8pc.src.rpm
python-async-timeout-0:4.0.3-0.1.el8pc.src.rpm
python-django-0:3.2.22-1.el8pc.src.rpm
python-flake8-0:5.0.0-0.1.el8pc.src.rpm
python-jinja2-0:3.1.3-0.1.el8pc.src.rpm
python-mccabe-0:0.7.0-0.1.el8pc.src.rpm
python-pulp-rpm-0:3.19.12-1.el8pc.src.rpm
python-pulpcore-0:3.22.22-2.el8pc.src.rpm
python-pycodestyle-0:2.9.1-0.1.el8pc.src.rpm
python-pyflakes-0:2.5.0-0.1.el8pc.src.rpm
satellite-0:6.14.3-1.el8sat.src.rpm
noarch:
python39-galaxy-importer-0:0.4.18-2.el8pc.noarch.rpm
python39-ansible-builder-0:1.2.0-1.el8pc.noarch.rpm
python39-async-timeout-0:4.0.3-0.1.el8pc.noarch.rpm
python39-django-0:3.2.22-1.el8pc.noarch.rpm
python39-flake8-0:5.0.0-0.1.el8pc.noarch.rpm
python39-jinja2-0:3.1.3-0.1.el8pc.noarch.rpm
python39-mccabe-0:0.7.0-0.1.el8pc.noarch.rpm
python39-pulp-rpm-0:3.19.12-1.el8pc.noarch.rpm
python39-pulpcore-0:3.22.22-2.el8pc.noarch.rpm
python39-pycodestyle-0:2.9.1-0.1.el8pc.noarch.rpm
python39-pyflakes-0:2.5.0-0.1.el8pc.noarch.rpm
satellite-0:6.14.3-1.el8sat.noarch.rpm
satellite-capsule-0:6.14.3-1.el8sat.noarch.rpm
satellite-cli-0:6.14.3-1.el8sat.noarch.rpm
satellite-common-0:6.14.3-1.el8sat.noarch.rpm
x86_64:
python-aiohttp-debugsource-0:3.9.2-0.1.el8pc.x86_64.rpm
python39-aiohttp-0:3.9.2-0.1.el8pc.x86_64.rpm
python39-aiohttp-debuginfo-0:3.9.2-0.1.el8pc.x86_64.rpm
Red Hat Satellite 6.14 for RHEL 8
noarch:
rubygem-hammer_cli_katello-0:1.9.1.3-1.el8sat.noarch.rpm
satellite-0:6.14.3-1.el8sat.noarch.rpm
satellite-capsule-0:6.14.3-1.el8sat.noarch.rpm
satellite-cli-0:6.14.3-1.el8sat.noarch.rpm
satellite-common-0:6.14.3-1.el8sat.noarch.rpm
Source:
rubygem-hammer_cli_katello-0:1.9.1.3-1.el8sat.src.rpm
satellite-0:6.14.3-1.el8sat.src.rpm
7. References:
https://access.redhat.com/security/cve/CVE-2023-5189
https://access.redhat.com/security/cve/CVE-2023-43665
https://access.redhat.com/security/cve/CVE-2023-47627
https://access.redhat.com/security/cve/CVE-2023-49081
https://access.redhat.com/security/cve/CVE-2024-22195
https://access.redhat.com/security/cve/CVE-2024-23334
https://access.redhat.com/security/cve/CVE-2024-23829
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/documentation/en-us/red_hat_satellite/6.14/html/upgrading_and_updating_red_hat_satellite/index
- --------------------------END INCLUDED TEXT----------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================