An update is now available for Red Hat Satellite 6.15. The release contains a
new version of Satellite and important security fixes for various components.

Red Hat Product Security has rated this update as having a security impact of
Important. A Common Vulnerability Scoring System (CVSS) base score, which gives
 a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s)
listed in the References section.

Security fixes:
* python-pygments: ReDoS in pygments (CVE-2022-40896)
* python-pycryptodomex: Side-channel leakage for OAEP decryption in
 PyCryptodome and pycryptodomex (CVE-2023-52323)
* satellite: Arithmetic overflow in satellite (CVE-2023-4320)
* automation-hub: Ansible Automation Hub: insecure galaxy-importer tarfile
 extraction (CVE-2023-5189)
* jetty: Improper addition of quotation marks to user inputs in CgiServlet
 (CVE-2023-36479)
* python-aiohttp: HTTP request smuggling via llhttp HTTP request parser (CVE-2023-37276)
* rubygem-activesupport: File Disclosure of Locally Encrypted Files
 (CVE-2023-38037)
* jetty: Improper validation of HTTP/1 content-length (CVE-2023-40167)
* python-django: Potential denial of service vulnerability in
 `django.utils.encoding.uri_to_iri()` (CVE-2023-41164)
* python-django: Denial-of-service possibility in django.utils.text.Truncator
 (CVE-2023-43665)
* python-aiohttp: Numerous issues in HTTP parser with header parsing (CVE-2023-47627)
* python-aiohttp: HTTP request modification (CVE-2023-49081)
* python-aiohttp: CRLF injection if user controls the HTTP method using aiohttp client (CVE-2023-49082)
* rubygem-puma: HTTP request smuggling when parsing chunked Transfer-Encoding
 Bodies (CVE-2024-21647)
* rubygem-audited: Race condition can lead to audit logs being incorrectly
 attributed to the wrong user (CVE-2024-22047)
* python-jinja2: HTML attribute injection when passing user input as keys to
 xmlattr filter (CVE-2024-22195)
* python-aiohttp: Follow_symlinks directory traversal vulnerability (CVE-2024-23334)
* python-aiohttp: HTTP request smuggling (CVE-2024-23829)

Additional Changes:
This update also fixes several bugs and adds various enhancements.

Documentation for these changes is available from the Release Notes document
 linked to in the References section.

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2022-40896: Unrestricted Upload of File with Dangerous Type (CWE-434)
CVE-2023-4320: Insufficient Session Expiration (CWE-613)
CVE-2023-5189
CVE-2023-36479: Improper Neutralization of Quoting Syntax (CWE-149)
CVE-2023-37276: Inconsistent Interpretation of HTTP Requests ('HTTP
 Request/Response Smuggling') (CWE-444)
CVE-2023-38037: Insecure Temporary File (CWE-377)
CVE-2023-40167: Improper Handling of Length Parameter Inconsistency (CWE-130)
CVE-2023-41164: Uncontrolled Resource Consumption (CWE-400)
CVE-2023-43665: Inefficient Regular Expression Complexity (CWE-1333)
CVE-2023-47627: Inconsistent Interpretation of HTTP Requests ('HTTP
 Request/Response Smuggling') (CWE-444)
CVE-2023-49081: Improper Input Validation (CWE-20)
CVE-2023-49082: Improper Neutralization of CRLF Sequences ('CRLF
 Injection') (CWE-93)
CVE-2023-52323: Observable Discrepancy (CWE-203)
CVE-2024-21647: Inconsistent Interpretation of HTTP Requests ('HTTP
 Request/Response Smuggling') (CWE-444)
CVE-2024-22047: Concurrent Execution using Shared Resource with Improper
 Synchronization ('Race Condition') (CWE-362)
CVE-2024-22195: Improper Neutralization of Input During Web Page Generation
 ('Cross-site Scripting') (CWE-79)
CVE-2024-23334: Improper Limitation of a Pathname to a Restricted Directory
 ('Path Traversal') (CWE-22)
CVE-2024-23829: Inconsistent Interpretation of HTTP Requests ('HTTP
 Request/Response Smuggling') (CWE-444)