Red Hat Security Advisory: Technical preview of the satellite/iop-vmaas-rhel9 container image
🔗 CVE IDs covered (5)
📋 Description
CVE-2026-63374 — anyio: AnyIO: TLS certificate spoofing via improper internationalized domain name encoding CVE-2026-84782 — openssl: compat-openssl: openssl: Information disclosure via DTLS handshake retransmission CVE-2026-87819 — GitPython: GitPython: Denial of Service via crafted commit author field CVE-2026-93599 — rustls-webpki: rustls-webpki: Denial of Service via crafted Certificate Revocation List CVE-2026-110857 — GitPython: GitPython: Arbitrary code execution via unsafe URL protocol handling
🎯 Affected products2
- Red Hat Satellite 6.18
- registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:8dbb1d9711871b543ced02e006f16ce1a680b4b45604c44798c1a49ffecc72cd_amd64 as a component of Red Hat Satellite 6.18
✅ Remediation
For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation. Workaround: Update GitPython to version 3.1.60 or later. Validate and sanitize git repository sources before processing. Enable git fsck validation (receive.fsckObjects) on git servers to reject malformed commit objects. Implement length limits on commit metadata fields before processing.
🔗 References (12)
- selfhttps://access.redhat.com/errata/RHSA-2026:92588
- externalhttps://access.redhat.com/documentation/en-us/red_hat_satellite/6.18/html/updating_red_hat_satellite/index
- externalhttps://access.redhat.com/security/cve/CVE-2026-110857
- externalhttps://access.redhat.com/security/cve/CVE-2026-63374
- externalhttps://access.redhat.com/security/cve/CVE-2026-84782
- externalhttps://access.redhat.com/security/cve/CVE-2026-87819
- externalhttps://access.redhat.com/security/cve/CVE-2026-93599
- externalhttps://access.redhat.com/security/updates/classification/
- externalhttps://catalog.redhat.com/software/containers/search
- externalhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.18/html/installing_satellite_server_in_a_connected_network_environment/performing-additional-configuration-on-server_satellite#installing-and-configuring-red-hat-lightspeed-in-satellite
- externalhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.18/html/installing_satellite_server_in_a_disconnected_network_environment/performing-additional-configuration#installing-and-configuring-red-hat-lightspeed-in-satellite
- selfhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_92588.json