- Issued:
- 2024-02-13
- Updated:
- 2024-02-13
RHSA-2024:0797 - Important: Satellite 6.14.2 Async Security Update
Synopsis
Important: Satellite 6.14.2 Async Security Update
Type/Severity
Security Advisory Important
Topic
Updated Satellite 6.14 packages that fixes Important security bugs and several regular bugs are now available for Red Hat Satellite.
Description
Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity to provide public Internet access to their servers or other client systems. It performs provisioning and configuration management of predefined standard operating environments.
Security fix(es):
- CVE-2023-26049 (puppetserver): Cookie parsing of quoted values can exfiltrate values from other cookies
- CVE-2023-26141 (rubygem-sidekiq): Denial of Service (DoS) in dashboard-charts
- CVE-2023-36479 (puppetserver): Improper addition of quotation marks to user inputs in CgiServlet
- CVE-2023-38545 (puppet-agent): Heap-based buffer overflow in the SOCKS5 proxy handshake
- CVE-2023-40167 (puppetserver): Improper validation of HTTP/1 content-length
- CVE-2023-40175 (rubygem-puma): HTTP request smuggling when parsing chunked transfer encoding bodies and zero-length content-length headers
- CVE-2023-4785 (rubygem-grpc): File descriptor exhaustion leads to denial of service
- CVE-2023-0809, CVE-2023-28366, CVE-2023-3592 (mosquitto): Memory leak leads to unresponsive broker
This update fixes the following bugs:
2250347 - 'Sun, 11 Jun 2023 17:51:29 GMT' could not be parsed at index 0 at java.time.format.DateTimeFormatter.parseResolved
2254974 - satellite-convert2rhel-toolkit install fails on latest rpm with /usr/bin/bash: /usr/libexec/satellite-convert2rhel-appliance/action-install.sh: No such file or directory
2255260 - 6.14 - satellite-convert2rhel-toolkit is part of the satellite module
2257321 - Request for UEFI Kickstart Provisioning to handle naming convention for VLAN tagged interfaces of the format <parent_device>.<vlan_id> in addition to vlan<vlan_id>
2257324 - Generate applicability tasks fails with error "ERROR: insert or update on table "katello_content_facet_errata" violates foreign key constraint "katello_content_facet_errata_ca_id"
2257326 - Show failed resources in failed installation report
2257327 - Puppet reports without any messages don't get an origin
2257329 - Host registration fails with error "Attached to can't be blank" when the VLAN name includes UPPERCASE letters
2257330 - default tuning profile leaves httpd MaxClients 150 which httpd raises a warning
2257331 - Registering host through load balancer causes REX not to know what capsule to choose for 'registered_through'
2257332 - Registration can't find any Capsules when their locations are not assigned to admin user
2257415 - Provisioning vm host fails with error "Failed to attach ISO image to CDROM drive of instance client.example.com: InvalidPowerState: The attempted operation cannot be performed in the current state (Powered on)".
2260525 - [Improvement] RefreshRepos step in Capsule Sync to refresh just repos to sync
2262131 - Unable to sync library/busybox from gcr.io
Users of Red Hat Satellite are advised to upgrade to these updated packages, which fix these bugs.
Solution
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
Affected Products
| Product | Version | Arch |
|---|---|---|
| Red Hat Satellite | 6.14 | x86_64 |
| Red Hat Satellite Capsule | 6.14 | x86_64 |
| Red Hat Enterprise Linux for x86_64 | 8 | x86_64 |
Updated Packages
- foreman-vmware-3.7.0.11-2.el8sat.noarch.rpm
- mosquitto-2.0.17-1.el8sat.x86_64.rpm
- puppetserver-7.14.0-1.el8sat.src.rpm
- rubygem-kafo-7.2.0-1.el8sat.src.rpm
- rubygem-kafo-7.2.0-1.el8sat.noarch.rpm
- rubygem-puma-6.3.1-1.el8sat.src.rpm
- foreman-libvirt-3.7.0.11-2.el8sat.noarch.rpm
- foreman-ovirt-3.7.0.11-2.el8sat.noarch.rpm
- foreman-redis-3.7.0.11-2.el8sat.noarch.rpm
- mosquitto-2.0.17-1.el8sat.src.rpm
- mosquitto-debuginfo-2.0.17-1.el8sat.x86_64.rpm
- rubygem-puma-6.3.1-1.el8sat.x86_64.rpm
- rubygem-google-protobuf-3.24.3-1.el8sat.x86_64.rpm
- rubygem-katello-4.9.0.21-1.el8sat.noarch.rpm
- rubygem-puma-debugsource-6.3.1-1.el8sat.x86_64.rpm
- rubygem-katello-4.9.0.21-1.el8sat.src.rpm
- rubygem-sidekiq-6.5.12-1.el8sat.src.rpm
- python-pulp-container-2.14.11-1.el8pc.src.rpm
- foreman-ec2-3.7.0.11-2.el8sat.noarch.rpm
- puppet-agent-7.27.0-1.el8sat.src.rpm
- candlepin-selinux-4.3.11-1.el8sat.noarch.rpm
- rubygem-puma-debuginfo-6.3.1-1.el8sat.x86_64.rpm
- rubygem-sidekiq-6.5.12-1.el8sat.noarch.rpm
- foreman-postgresql-3.7.0.11-2.el8sat.noarch.rpm
- rubygem-google-protobuf-debuginfo-3.24.3-1.el8sat.x86_64.rpm
- mosquitto-debugsource-2.0.17-1.el8sat.x86_64.rpm
- foreman-3.7.0.11-2.el8sat.src.rpm
- puppet-agent-7.27.0-1.el8sat.x86_64.rpm
- satellite-cli-6.14.2-1.el8sat.noarch.rpm
- foreman-dynflow-sidekiq-3.7.0.11-2.el8sat.noarch.rpm
- satellite-common-6.14.2-1.el8sat.noarch.rpm
- satellite-convert2rhel-toolkit-1.0.1-1.el8sat.src.rpm
- satellite-capsule-6.14.2-1.el8sat.noarch.rpm
- rubygem-grpc-1.58.0-1.el8sat.src.rpm
- rubygem-foreman_bootdisk-21.2.1-1.el8sat.src.rpm
- puppetserver-7.14.0-1.el8sat.noarch.rpm
- foreman-journald-3.7.0.11-2.el8sat.noarch.rpm
- foreman-installer-3.7.0.7-1.el8sat.src.rpm
- foreman-openstack-3.7.0.11-2.el8sat.noarch.rpm
- foreman-debug-3.7.0.11-2.el8sat.noarch.rpm
- foreman-cli-3.7.0.11-2.el8sat.noarch.rpm
- foreman-telemetry-3.7.0.11-2.el8sat.noarch.rpm
- candlepin-4.3.11-1.el8sat.src.rpm
- foreman-3.7.0.11-2.el8sat.noarch.rpm
- foreman-installer-katello-3.7.0.7-1.el8sat.noarch.rpm
- python39-pulp-container-2.14.11-1.el8pc.noarch.rpm
- rubygem-foreman_bootdisk-21.2.1-1.el8sat.noarch.rpm
- rubygem-grpc-1.58.0-1.el8sat.x86_64.rpm
- candlepin-4.3.11-1.el8sat.noarch.rpm
- satellite-6.14.2-1.el8sat.noarch.rpm
- satellite-6.14.2-1.el8sat.src.rpm
- satellite-convert2rhel-toolkit-1.0.1-1.el8sat.x86_64.rpm
- foreman-service-3.7.0.11-2.el8sat.noarch.rpm
- rubygem-google-protobuf-debugsource-3.24.3-1.el8sat.x86_64.rpm
- rubygem-google-protobuf-3.24.3-1.el8sat.src.rpm
- foreman-installer-3.7.0.7-1.el8sat.noarch.rpm
Fixes
- This content is not included.BZ - 2232729
- This content is not included.BZ - 2236341
- This content is not included.BZ - 2236882
- This content is not included.BZ - 2239010
- This content is not included.BZ - 2239017
- This content is not included.BZ - 2239630
- This content is not included.BZ - 2239634
- This content is not included.BZ - 2241933
- This content is not included.BZ - 2250347
- This content is not included.BZ - 2254974
- This content is not included.BZ - 2255260
- This content is not included.BZ - 2257321
- This content is not included.BZ - 2257324
- This content is not included.BZ - 2257326
- This content is not included.BZ - 2257327
- This content is not included.BZ - 2257329
- This content is not included.BZ - 2257330
- This content is not included.BZ - 2257331
- This content is not included.BZ - 2257332
- This content is not included.BZ - 2257415
- This content is not included.BZ - 2260525
- This content is not included.BZ - 2262131
CVEs
- CVE-2023-0809
- CVE-2023-3592
- CVE-2023-4785
- CVE-2023-26049
- CVE-2023-26141
- CVE-2023-28366
- CVE-2023-36479
- CVE-2023-38545
- CVE-2023-40167
- CVE-2023-40175
References
- https://access.redhat.com/security/updates/classification/#important
- This content is not included.This content is not included.https://access.redhat.com/documentation/en-us/red_hat_satellite/6.14/html/upgrading_and_updating_red_hat_satellite/index
Additional information
- The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
- Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.