Red Hat Security Advisory: Technical preview of the satellite/iop-vmaas-rhel9 container image
🔗 CVE IDs covered (8)
📋 Description
CVE-2026-26007 — cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves CVE-2026-63374 — anyio: AnyIO: TLS certificate spoofing via improper internationalized domain name encoding CVE-2026-84782 — openssl: compat-openssl: openssl: Information disclosure via DTLS handshake retransmission CVE-2026-87819 — GitPython: GitPython: Denial of Service via crafted commit author field CVE-2026-93599 — rustls-webpki: rustls-webpki: Denial of Service via crafted Certificate Revocation List CVE-2026-110856 — GitPython: GitPython: Denial of Service via regular expression backtracking in date parsing CVE-2026-110857 — GitPython: GitPython: Arbitrary code execution via unsafe URL protocol handling CVE-2026-110859 — GitPython: GitPython: Arbitrary file read via argument injection in branch checkout
🎯 Affected products2
- Red Hat Satellite 6.19
- registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:fcdb765a20d5b6e45582984b2c78a9f86b0b8cd17d25cf969564a55042e0febb_amd64 as a component of Red Hat Satellite 6.19
✅ Remediation
For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Update GitPython to version 3.1.60 or later. Validate and sanitize git repository sources before processing. Enable git fsck validation (receive.fsckObjects) on git servers to reject malformed commit objects. Implement length limits on commit metadata fields before processing.
🔗 References (15)
- selfhttps://access.redhat.com/errata/RHSA-2026:92574
- externalhttps://access.redhat.com/documentation/en-us/red_hat_satellite/6.19/html/updating_red_hat_satellite/index
- externalhttps://access.redhat.com/security/cve/CVE-2026-110856
- externalhttps://access.redhat.com/security/cve/CVE-2026-110857
- externalhttps://access.redhat.com/security/cve/CVE-2026-110859
- externalhttps://access.redhat.com/security/cve/CVE-2026-26007
- externalhttps://access.redhat.com/security/cve/CVE-2026-63374
- externalhttps://access.redhat.com/security/cve/CVE-2026-84782
- externalhttps://access.redhat.com/security/cve/CVE-2026-87819
- externalhttps://access.redhat.com/security/cve/CVE-2026-93599
- externalhttps://access.redhat.com/security/updates/classification/
- externalhttps://catalog.redhat.com/software/containers/search
- externalhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/installing_satellite_server_in_a_connected_network_environment/performing-additional-configuration-on-server_satellite#installing-and-configuring-red-hat-lightspeed-in-satellite
- externalhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/installing_satellite_server_in_a_disconnected_network_environment/performing-additional-configuration#installing-and-configuring-red-hat-lightspeed-in-satellite
- selfhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_92574.json