RHSA-2022:5498: Moderate: Satellite 6.11 Release

Red Hat Satellite is a systems management tool for Linux-based<br>infrastructure. It allows for provisioning, remote management, and<br>monitoring of multiple Linux deployments with a single centralized tool.<br>Security Fix(es):<br><li> libsolv: Heap-based buffer overflow in testcaseread() in src/testcase.c (CVE-2021-3200) </li> <li> satellite: foreman: Authenticate remote code execution through Sendmail configuration (CVE-2021-3584)</li> <li> candlepin: Allow unintended SCA certificate to authenticate Candlepin (CVE-2021-4142)</li> <li> candlepin: netty: Information disclosure via the local system temporary directory (CVE-2021-21290)</li> <li> candlepin: netty: Possible request smuggling in HTTP/2 due missing validation (CVE-2021-21295)</li> <li> candlepin: netty: Request smuggling via content-length header (CVE-2021-21409)</li> <li> tfm-rubygem-sidekiq: XSS via the queue name of the live-poll feature (CVE-2021-30151)</li> <li> python-sqlparse: ReDoS via regular expression in StripComments filter (CVE-2021-32839)</li> <li> libsolv: various flaws (CVE-2021-33928 CVE-2021-33929 CVE-2021-33930 CVE-2021-33938)</li> <li> tfm-rubygem-puma: Inconsistent Interpretation of HTTP Requests in puma (CVE-2021-41136)</li> <li> logback-classic: Remote code execution through JNDI call from within its configuration file (CVE-2021-42550)</li> <li> candlepin: netty: Control chars in header names may lead to HTTP request smuggling (CVE-2021-43797)</li> <li> python-lxml: HTML Cleaner allows crafted and SVG embedded scripts to pass through (CVE-2021-43818)</li> <li> python3-django: Potential bypass of an upstream access control based on URL paths (CVE-2021-44420) </li> <li> libsolv: Heap overflow (CVE-2021-44568)</li> <li> python3-django: Various flaws (CVE-2021-45115 CVE-2021-45116 CVE-2021-45452 CVE-2022-22818)</li> <li> tfm-rubygem-actionpack: Information leak between requests (CVE-2022-23633)</li> <li> tfm-rubygem-puma: rubygem-rails: Information leak between requests (CVE-2022-23634)</li> <li> python3-django: Denial-of-service possibility in file uploads (CVE-2022-23833)</li> <li> tfm-rubygem-sidekiq: WebUI Denial of Service caused by number of days on graph (CVE-2022-23837)</li> <li> python3-django: Various flaws (CVE-2022-28346 CVE-2022-28347)</li> For more details about the security issue(s), including the impact, a CVSS<br>score, acknowledgments, and other related information, refer to the CVE<br>page(s) listed in the References section.<br>Additional Changes:<br><li> New repo layout for Satellite, Utils, Maintenance, and Client repos.</li> <li> Support for RHEL 9 clients</li> <li> Module-based installation on RHEL 8</li> <li> Upgrading Satellite Server and Capsule Server installations from RHEL 7 to RHEL 8</li> <li> Connected and Disconnected servers supported on RHEL 7 and RHEL 8</li> <li> Inter-Server Synchronization improvements</li> <li> Puppet integration optional and disabled by default</li> <li> Pulp 3 updated to Python 3.8</li> <li> Change to Capsule certificate archive</li> <li> New default port for communication with Red Hat Subscription Management (RHSM) API on Capsule servers</li> <li> New Content Views Page (Content Publication workflow simplification)</li> <li> New Hosts Page (Technology Preview)</li> <li> Registration and preview templates</li> <li> Simplified host content source changing</li> <li> Improved behavior for configuring and running remote jobs</li> <li> Provisioning improvements</li> <li> New error signaling unsupported options in TASK-Filter</li> <li> Virt-who configuration enhanced to support Nutanix AHV</li> <li> Cloud Connector configuration updated</li> <li> Improved Insights adoption</li> The items above are not a complete list of changes. This update also fixes<br>several bugs and adds various enhancements. Documentation for these changes<br>is available from the Release Notes document linked to in the References<br>section.