RHSA-2025:17613 Red Hat Satellite 6.16.5.4 Security Update (CVE-2025-57052/57833)

RHSA-2025:17613 - Security Advisory - Synopsis: Important: Satellite 6.16.5.4 Async Update - Type/Severity: Important - Topic: A new release is now available for Red Hat Satellite 6.16 for RHEL 8 and 9. - Description: Security Fix(es): - json: out-of-bounds access in decode_array_index_from_pointer() in cJSON_Utils.c via crafted JSON pointer strings (CVE-2025-57052) - python-django: Django SQL injection in FilteredRelation column aliases (CVE-2025-57833) - puppet-agent: incomplete fix for CVE-2024-49761 (CVE-2025-10990) - Fail to upgrade to Satellite 6.16 when Satellite has more than 520 users (SAT-38406) - Ensure host key cleanup of /usr/share/foreman-proxy/.ssh/known_hosts on the Satellite (or Capsule) server when first remote execution is using Ansible (SAT-38408) - Installer loads plugins from /opt/puppetlabs/puppet/cache/lib/, breaking PostgreSQL config updates and thus upgrades from 6.15 to 6.16 (max_connections is not updated) (SAT-38410) - Second container push set manifest size fields to -1, which breaks bootc (SAT-38411) - Solution: - Before applying this update, make sure all previously released errata relevant to your system have been applied. - For details on how to apply this update, refer to this link - Affected Products: - Red Hat Satellite 6.16 for RHEL 9 x86_64 - Red Hat Satellite 6.16 for RHEL 8 x86_64 - Red Hat Satellite Capsule 6.16 for RHEL 9 x86_64 - Red Hat Satellite Capsule 6.16 for RHEL 8 x86_64 - Red Hat Enterprise Linux for x86_64 9 x86_64 - Red Hat Enterprise Linux for x86_64 8 x86_64 - Fixes: - CVE-2025-57052 - cJSON - CVE-2025-57833 - django - CVE-2025-10990 - rexml - SAT-38406 - Fail to upgrade to Satellite 6.16 when Satellite has more than 520 users - SAT-38408 - Ensure host key cleanup of /usr/share/foreman-proxy/.ssh/known_hosts on the Satellite (or Capsule) server when first remote execution is using Ansible - SAT-38410 - Installer loads plugins from /opt/puppetlabs/puppet/cache/lib/, breaking PostgreSQL config updates and thus upgrades from 6.15 to 6.16 (max_connections is not updated) - SAT-38411 - Second container push set manifest size fields to -1, which breaks bootc - CVEs: - CVE-2025-10990 - CVE-2025-57052 - CVE-2025-57833 - References: - Security Classification: Important

目標達成すべての支援者に感謝 — 100%達成しました！

RHSA-2025:17613 Red Hat Satellite 6.16.5.4 Security Update (CVE-2025-57052/57833)

このソースからの他の記事

目標達成 すべての支援者に感謝 — 100%達成しました！

RHSA-2025:17613 Red Hat Satellite 6.16.5.4 Security Update (CVE-2025-57052/57833)

このソースからの他の記事

目標達成すべての支援者に感謝 — 100%達成しました！