title: Red Hat Security Advisory: Satellite 6.12 Release
description: netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way django: Possible XSS via '{% debug %}' template tag nokogiri: ReDoS in HTML encoding detection ruby-git: package vulnerable to Command Injection via git argument injection rubygem-nokogiri: Improper Handling of Unexpected Data Type in Nokogiri sinatra: path traversal possible outside of public_dir when serving static files rubygem-rails-html-sanitizer: possible xss with certain configurations python-django: Potential SQL injection via Trunc(kind) and Extract(lookup_name) arguments foreman: foreman: OAuth secret exposure via unauthenticated access to the GraphQL API
cpes: cpe:/a:redhat:satellite:6.12::el8 cpe:/a:redhat:satellite_capsule:6.12::el8 cpe:/a:redhat:satellite_maintenance:6.12::el8 cpe:/a:redhat:satellite_utils:6.12::el8