exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Red Hat Security Advisory 2024-0797-03

Red Hat Security Advisory 2024-0797-03
Posted Feb 13, 2024
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2024-0797-03 - Updated Satellite 6.14 packages that fixes Important security bugs and several regular bugs are now available for Red Hat Satellite. Issues addressed include HTTP request smuggling, buffer overflow, denial of service, and memory leak vulnerabilities.

tags | advisory, web, denial of service, overflow, vulnerability, memory leak
systems | linux, redhat
advisories | CVE-2023-0809
SHA-256 | fdbbd57607f130b4c54c0800d0beaa175779ea55ec23b8708b91d7e8a5db788e

Red Hat Security Advisory 2024-0797-03

Change Mirror Download


The following advisory data is extracted from:

https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_0797.json

Red Hat officially shut down their mailing list notifications October 10, 2023. Due to this, Packet Storm has recreated the below data as a reference point to raise awareness. It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.

- Packet Storm Staff




====================================================================
Red Hat Security Advisory

Synopsis: Important: Satellite 6.14.2 Async Security Update
Advisory ID: RHSA-2024:0797-03
Product: Red Hat Satellite 6
Advisory URL: https://access.redhat.com/errata/RHSA-2024:0797
Issue date: 2024-02-13
Revision: 03
CVE Names: CVE-2023-0809
====================================================================

Summary:

Updated Satellite 6.14 packages that fixes Important security bugs and several
regular bugs are now available for Red Hat Satellite.




Description:

Red Hat Satellite is a system management solution that allows organizations
to configure and maintain their systems without the necessity to provide
public Internet access to their servers or other client systems. It
performs provisioning and configuration management of predefined standard
operating environments.

Security fix(es):
* CVE-2023-26049 (puppetserver): Cookie parsing of quoted values can exfiltrate values from other cookies
* CVE-2023-26141 (rubygem-sidekiq): Denial of Service (DoS) in dashboard-charts
* CVE-2023-36479 (puppetserver): Improper addition of quotation marks to user inputs in CgiServlet
* CVE-2023-38545 (puppet-agent): Heap-based buffer overflow in the SOCKS5 proxy handshake
* CVE-2023-40167 (puppetserver): Improper validation of HTTP/1 content-length
* CVE-2023-40175 (rubygem-puma): HTTP request smuggling when parsing chunked transfer encoding bodies and zero-length content-length headers
* CVE-2023-4785 (rubygem-grpc): File descriptor exhaustion leads to denial of service
* CVE-2023-0809, CVE-2023-28366, CVE-2023-3592 (mosquitto): Memory leak leads to unresponsive broker

This update fixes the following bugs:
2250347 - 'Sun, 11 Jun 2023 17:51:29 GMT' could not be parsed at index 0 at java.time.format.DateTimeFormatter.parseResolved
2254974 - satellite-convert2rhel-toolkit install fails on latest rpm with `/usr/bin/bash: /usr/libexec/satellite-convert2rhel-appliance/action-install.sh: No such file or directory`
2255260 - 6.14 - satellite-convert2rhel-toolkit is part of the satellite module
2257321 - Request for UEFI Kickstart Provisioning to handle naming convention for VLAN tagged interfaces of the format <parent_device>.<vlan_id> in addition to vlan<vlan_id>
2257324 - Generate applicability tasks fails with error \"ERROR: insert or update on table \"katello_content_facet_errata\" violates foreign key constraint \"katello_content_facet_errata_ca_id\"
2257326 - Show failed resources in failed installation report
2257327 - Puppet reports without any messages don't get an origin
2257329 - Host registration fails with error \"Attached to can't be blank\" when the VLAN name includes UPPERCASE letters
2257330 - default tuning profile leaves httpd MaxClients 150 which httpd raises a warning
2257331 - Registering host through load balancer causes REX not to know what capsule to choose for 'registered_through'
2257332 - Registration can't find any Capsules when their locations are not assigned to admin user
2257415 - Provisioning vm host fails with error \"Failed to attach ISO image to CDROM drive of instance client.example.com: InvalidPowerState: The attempted operation cannot be performed in the current state (Powered on)\".
2260525 - [Improvement] RefreshRepos step in Capsule Sync to refresh just repos to sync
2262131 - Unable to sync library/busybox from gcr.io

Users of Red Hat Satellite are advised to upgrade to these updated
packages, which fix these bugs.


Solution:

https://access.redhat.com/articles/11258



CVEs:

CVE-2023-0809

References:

https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/documentation/en-us/red_hat_satellite/6.14/html/upgrading_and_updating_red_hat_satellite/index
https://bugzilla.redhat.com/show_bug.cgi?id=2232729
https://bugzilla.redhat.com/show_bug.cgi?id=2236341
https://bugzilla.redhat.com/show_bug.cgi?id=2236882
https://bugzilla.redhat.com/show_bug.cgi?id=2239010
https://bugzilla.redhat.com/show_bug.cgi?id=2239017
https://bugzilla.redhat.com/show_bug.cgi?id=2239630
https://bugzilla.redhat.com/show_bug.cgi?id=2239634
https://bugzilla.redhat.com/show_bug.cgi?id=2241933
https://bugzilla.redhat.com/show_bug.cgi?id=2250347
https://bugzilla.redhat.com/show_bug.cgi?id=2254974
https://bugzilla.redhat.com/show_bug.cgi?id=2255260
https://bugzilla.redhat.com/show_bug.cgi?id=2257321
https://bugzilla.redhat.com/show_bug.cgi?id=2257324
https://bugzilla.redhat.com/show_bug.cgi?id=2257326
https://bugzilla.redhat.com/show_bug.cgi?id=2257327
https://bugzilla.redhat.com/show_bug.cgi?id=2257329
https://bugzilla.redhat.com/show_bug.cgi?id=2257330
https://bugzilla.redhat.com/show_bug.cgi?id=2257331
https://bugzilla.redhat.com/show_bug.cgi?id=2257332
https://bugzilla.redhat.com/show_bug.cgi?id=2257415
https://bugzilla.redhat.com/show_bug.cgi?id=2260525
https://bugzilla.redhat.com/show_bug.cgi?id=2262131

Login or Register to add favorites

File Archive:

April 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    10 Files
  • 2
    Apr 2nd
    26 Files
  • 3
    Apr 3rd
    40 Files
  • 4
    Apr 4th
    6 Files
  • 5
    Apr 5th
    26 Files
  • 6
    Apr 6th
    0 Files
  • 7
    Apr 7th
    0 Files
  • 8
    Apr 8th
    22 Files
  • 9
    Apr 9th
    14 Files
  • 10
    Apr 10th
    10 Files
  • 11
    Apr 11th
    13 Files
  • 12
    Apr 12th
    14 Files
  • 13
    Apr 13th
    0 Files
  • 14
    Apr 14th
    0 Files
  • 15
    Apr 15th
    30 Files
  • 16
    Apr 16th
    10 Files
  • 17
    Apr 17th
    0 Files
  • 18
    Apr 18th
    0 Files
  • 19
    Apr 19th
    0 Files
  • 20
    Apr 20th
    0 Files
  • 21
    Apr 21st
    0 Files
  • 22
    Apr 22nd
    0 Files
  • 23
    Apr 23rd
    0 Files
  • 24
    Apr 24th
    0 Files
  • 25
    Apr 25th
    0 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close