title: Red Hat Security Advisory: Satellite 6.16.0 release
description: micromatch: vulnerable to Regular Expression Denial of Service github.com/jaraco/zipp: Denial of Service (infinite loop) via crafted zip file in jaraco/zipp puppet-foreman: An authentication bypass vulnerability exists in Foreman grpc: client communicating with a HTTP/2 proxy can poison the HPACK table between the proxy and the backend puppet-pulpcore: An authentication bypass vulnerability exists in pulpcore mosquitto: sending specific sequences of packets may trigger memory leak foreman: Read-only access to entire DB from templates node-tar: denial of service while parsing a tar file due to lack of folders depth validation urllib3: proxy-authorization request header is not stripped during cross-origin redirects python-django: Potential denial-of-service in django.utils.html.urlize() python-django: Username enumeration through timing difference for users with unusable passwords python-django: Potential directory-traversal in django.core.files.storage.Storage.save() python-django: Potential denial-of-service in django.utils.translation.get_supported_language_variant() python-django: Potential SQL injection in QuerySet.values() and values_list()
cpes: cpe:/a:redhat:satellite:6.16::el8 cpe:/a:redhat:satellite:6.16::el9 cpe:/a:redhat:satellite_capsule:6.16::el8 cpe:/a:redhat:satellite_capsule:6.16::el9 cpe:/a:redhat:satellite_maintenance:6.16::el8 cpe:/a:redhat:satellite_maintenance:6.16::el9 cpe:/a:redhat:satellite_utils:6.16::el8 cpe:/a:redhat:satellite_utils:6.16::el9