Red Hat Security Advisory: satellite/iop-vulnerability-engine-rhel9 container image available as a Technology Preview

🔗 CVE IDs covered (4)

📋 Description

🎯 Affected products2

• Red Hat Satellite 6.18
• registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:4a57b227eeb2d3d391ff8c2b9754800b5e776bf93f4c53b4d629f626eb7af685_amd64 as a component of Red Hat Satellite 6.18

✅ Remediation

For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation. Workaround: Update GitPython to version 3.1.60 or later. Validate and sanitize git repository sources before processing. Enable git fsck validation (receive.fsckObjects) on git servers to reject malformed commit objects. Implement length limits on commit metadata fields before processing.

🔗 References (11)

• selfhttps://access.redhat.com/errata/RHSA-2026:92620
• externalhttps://access.redhat.com/documentation/en-us/red_hat_satellite/6.18/html/updating_red_hat_satellite/index
• externalhttps://access.redhat.com/security/cve/CVE-2026-110857
• externalhttps://access.redhat.com/security/cve/CVE-2026-84782
• externalhttps://access.redhat.com/security/cve/CVE-2026-87819
• externalhttps://access.redhat.com/security/cve/CVE-2026-93599
• externalhttps://access.redhat.com/security/updates/classification/
• externalhttps://catalog.redhat.com/software/containers/search
• externalhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.18/html/installing_satellite_server_in_a_connected_network_environment/performing-additional-configuration-on-server_satellite#installing-and-configuring-red-hat-lightspeed-in-satellite
• externalhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.18/html/installing_satellite_server_in_a_disconnected_network_environment/performing-additional-configuration#installing-and-configuring-red-hat-lightspeed-in-satellite
• selfhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_92620.json