title: Red Hat Security Advisory: Satellite 6.13 Release
description: jackson-databind: Possible DoS if using JDK serialization to serialize JsonNode SnakeYaml: Constructor Deserialization Remote Code Execution rubygem-actionpack: Possible cross-site scripting vulnerability in Action Pack rubygem-loofah: inefficient regular expression leading to denial of service rubygem-loofah: Improper neutralization of data URIs leading to Cross Site Scripting rubygem-loofah: Uncontrolled Recursion leading to denial of service rubygem-rails-html-sanitizer: Inefficient Regular Expression leading to denial of service rubygem-rails-html-sanitizer: Improper neutralization of data URIs leading to Cross site scripting rubygem-rails-html-sanitizer: Cross site scripting vulnerability with certain configurations rubygem-rails-html-sanitizer: Cross site scripting vulnerability with certain configurations snakeyaml: Denial of Service due to missing nested depth limitation for collections tfm-rubygem-actionview: Possible cross-site scripting vulnerability in Action View tag helpers rubygem-tzinfo: arbitrary code execution activerecord: Possible RCE escalation bug with Serialized Columns in Active Record apache-commons-configuration: Apache Commons Configuration insecure interpolation defaults snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match snakeyaml: Uncaught exception in java.base/java.util.ArrayList.hashCode python-django: Potential denial-of-service vulnerability in internationalized URLs postgresql-jdbc: Information leak of prepared statement data due to insecure temporary file permissions jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS jackson-databind: use of deeply nested arrays apache-commons-text: variable interpolation RCE python-django: Potential denial-of-service via Accept-Language headers python-django: Potential denial-of-service vulnerability in file uploads
cpes: cpe:/a:redhat:satellite:6.13::el8 cpe:/a:redhat:satellite_capsule:6.13::el8 cpe:/a:redhat:satellite_maintenance:6.13::el8 cpe:/a:redhat:satellite_utils:6.13::el8