RHSA-2021:4702: Moderate: Satellite 6.10 Release

Red Hat Satellite is a systems management tool for Linux-based<br>infrastructure. It allows for provisioning, remote management, and<br>monitoring of multiple Linux deployments with a single centralized tool.<br>Security Fix(es):<br><li> python-ecdsa: Unexpected and undocumented exceptions during signature decoding (CVE-2019-14853)</li> <li> python-ecdsa: DER encoding is not being verified in signatures (CVE-2019-14859)</li> <li> rubygem-activerecord-sessionstore: hijack sessions by using timing attacks targeting the session id (CVE-2019-25025)</li> <li> rake: OS Command Injection via egrep in Rake::FileList (CVE-2020-8130) </li> <li> candlepin: guava - local information disclosure via temporary directory created with unsafe permissions (CVE-2020-8908)</li> <li> PyYAML: incomplete fix for CVE-2020-1747 (CVE-2020-14343)</li> <li> tfm-rubygem-nokogiri: XML external entity injection via Nokogiri::XML::Schema (CVE-2020-26247)</li> <li> tfm-rubygem-foremanazurerm: Azure compute resource secretkey leak to authenticated users (CVE-2021-3413)</li> <li> foreman: possible man-in-the-middle in smartproxy realmfreeipa (CVE-2021-3494)</li> <li> foreman: BMC controller credential leak via API (CVE-2021-20256)</li> <li> python-aio<a href="http:" target="blank">http:</a> Open redirect in aiohttp.webmiddlewares.normalizepathmiddleware (CVE-2021-21330)</li> <li> rubygem-actionpack: Possible Information Disclosure / Unintended Method Execution in Action Pack (CVE-2021-22885)</li> <li> tfm-rubygem-actionpack: rails: Possible Denial of Service vulnerability in Action Dispatch (CVE-2021-22902)</li> <li> tfm-rubygem-actionpack: Possible DoS Vulnerability in Action Controller Token Authentication (CVE-2021-22904)</li> <li> python-django: potential directory-traversal via uploaded files (CVE-2021-28658)</li> <li> tfm-rubygem-puma: incomplete fix for CVE-2019-16770 allows Denial of Service (DoS) (CVE-2021-29509)</li> <li> python-django: Potential directory-traversal via uploaded files (CVE-2021-31542)</li> <li> tfm-rubygem-addressable: ReDoS in templates (CVE-2021-32740)</li> <li> python-django: Potential directory traversal via admindocs (CVE-2021-33203)</li> <li> python-urllib3: ReDoS in the parsing of authority part of URL (CVE-2021-33503)</li> <li> python-django: Possible indeterminate SSRF, RFI, and LFI attacks since validators accepted leading zeros in IPv4 addresses (CVE-2021-33571)</li> For more details about the security issue(s), including the impact, a CVSS<br>score, acknowledgments, and other related information, refer to the CVE<br>page(s) listed in the References section.<br>Additional Changes:<br><li> Updated Content Management backend with Pulp 3 for increased performance, scale and reliability. MongoDB is also removed from Satellite</li> <li> Adds support for Azure GovCloud</li> <li> Provides Satellite 6.10 Server support for Satellite 6.9 Capsules </li> <li> Improves support for Satellite Air Gapped and Disconnected environments</li> <li> Adds Ansible Collections content type to support disconnected environments</li> <li> Foremanwebhooks introduced to replace foremanhooks</li> <li> Introduces UI to manage Personal Access Tokens</li> <li> Adds ability to configure Pulp repository synchronization timeouts</li> <li> Support for Convert2RHEL</li> <li> Provides advanced options when registering a host</li> <li> Supports remediation playbook signatures from console.redhat.com</li> <li> Red Hat Insights Plugin replaced through new integration within Satellite</li> <li> Ability to visually represent systems registered and in sync with Insights</li> <li> Ability to verify if required packages are installed as part of pre-upgrade check</li> <li> Ability to unset environment variables when installer is running</li> <li> Ability to turn backups on and off when cleaning up tasks from database</li> The items above are not a complete list of changes. This update also fixes<br>several bugs and adds various enhancements. Documentation for these changes<br>is available from the Release Notes document linked to in the References<br>section.