RHSA-2026:34365 Red Hat Satellite 6.19.2 Security Update Advisory

Vulnerability Overview Vulnerability ID: RHSA-2026:34365 Release Date: 2026-07-01 Severity: Important Type: Security Update Description: Red Hat Satellite 6.19.2 asynchronous update addressing multiple security vulnerabilities, including arbitrary code execution, certificate validation bypass, denial of service, and information disclosure. Affected Products Affected Products: - Red Hat Satellite 6.19 x86_64 - Red Hat Satellite Capsule 6.19 x86_64 - Red Hat Enterprise Linux for x86_64 Remediation Solution: Ensure that all previously released errata have been applied to your systems before applying this update. Guidance: Refer to the Red Hat Official Documentation for detailed update steps. Vulnerability Details Fixed Vulnerabilities: - candlepin: nchance-commons-java: Arbitrary code execution via JNDI dereferencing (CVE-2026-27727) - yggdrasil-worker-forwarder: Incorrect parsing of IPv6 host literals (CVE-2026-25679) - yggdrasil-worker-forwarder: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint checking (CVE-2026-33810) - yggdrasil-worker-forwarder: RootChmod can follow symbolic links in the root directory (CVE-2026-32282) - yggdrasil-worker-forwarder: Go: Denial of service due to service flaws in certificate building (CVE-2026-32289) - yggdrasil-worker-forwarder: Go crypto/tls: Denial of service due to multiple TLS 1.3 KeyUpdate messages (CVE-2026-32283) - yggdrasil-worker-forwarder: Go crypto/x509: Denial of service due to invalid certificate verification (CVE-2026-32281) - python-pillow: Pillow: Denial of service due to decompression bombs (CVE-2026-40192) - python-pyjwt: PyJWT: Denial of service due to forged JSON Web Tokens (CVE-2026-40236) - foreman: Foreman: Cross-tenant private SSH key leakage due to classification scoring bypass (CVE-2026-5142) - foreman: Foreman: Information disclosure due to incorrect request parameters (CVE-2026-5138) - foreman: Foreman: Privilege escalation due to administrative level access via role permission manipulation (CVE-2026-5136) - foreman: Foreman: Unauthorized host configuration modification due to broken access control (CVE-2026-5135) Updated Packages Red Hat Satellite 6.19: - candlepin-4.7.5-1.el9sat.src.rpm - foreman-3.18.0.7-1.el9sat.src.rpm - python3.12-pillow-12.2.0-1.el9pc.x86_64.rpm - etc... Red Hat Satellite Capsule 6.19: - foreman-3.18.0.7-1.el9sat.src.rpm - python3.12-pillow-12.2.0-1.el9pc.x86_64.rpm - etc... Red Hat Enterprise Linux for x86_64: - foreman-3.18.0.7-1.el9sat.src.rpm - python3.12-pillow-12.2.0-1.el9pc.x86_64.rpm - etc... References Red Hat Security Updates Notes More recent versions of these packages may be available. Click on the package names for more details. Contact Information Red Hat Security Team: secalert@redhat.com More Information: Red Hat Security Team Contact Page --- Note: No Proof of Concept (POC) or exploit code is included in this document.

Goal Reached Thanks to every supporter — we hit 100%!

RHSA-2026:34365 Red Hat Satellite 6.19.2 Security Update Advisory

More from this source