RHSA-2025:19832HighCVSS 8.0
Red Hat Security Advisory: Satellite 6.17.6 Async Update
🔗 CVE IDs covered (3)
📋 Description
CVE-2025-10622 — foreman: OS command injection via ct_location and fcct_location parameters
CVE-2025-59830 — rubygem-rack: Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parameters
CVE-2025-61919 — rubygem-rack: Unbounded read in Rack::Request form parsing can lead to memory exhaustion
🔗 References (14)
- selfhttps://access.redhat.com/errata/RHSA-2025:19832
- externalhttps://access.redhat.com/security/updates/classification/#important
- externalhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.17/html/updating_red_hat_satellite/index
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=2396020
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=2398167
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=2403180
- externalhttps://issues.redhat.com/browse/SAT-39213
- externalhttps://issues.redhat.com/browse/SAT-39215
- externalhttps://issues.redhat.com/browse/SAT-39216
- externalhttps://issues.redhat.com/browse/SAT-39217
- externalhttps://issues.redhat.com/browse/SAT-39218
- externalhttps://issues.redhat.com/browse/SAT-39219
- externalhttps://issues.redhat.com/browse/SAT-39232
- selfhttps://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_19832.json