title: Red Hat Security Advisory: Satellite 6.11 Release
description: libsolv: heap-based buffer overflow in testcase_read() in src/testcase.c foreman: Authenticate remote code execution through Sendmail configuration Satellite: Allow unintended SCA certificate to authenticate Candlepin netty: Information disclosure via the local system temporary directory netty: possible request smuggling in HTTP/2 due missing validation netty: Request smuggling via content-length header sidekiq: XSS via the queue name of the live-poll feature python-sqlparse: ReDoS via regular expression in StripComments filter libsolv: heap-based buffer overflow in pool_installable() in src/repo.h libsolv: heap-based buffer overflow in pool_disabled_solvable() in src/repo.h libsolv: heap-based buffer overflow in pool_installable_whatprovides() in src/repo.h libsolv: heap-based buffer overflow in prune_to_recommended() in src/policy.c rubygem-puma: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in puma logback: remote code execution through JNDI call from within its configuration file netty: control chars in header names may lead to HTTP request smuggling python-lxml: HTML Cleaner allows crafted and SVG embedded scripts to pass through django: potential bypass of an upstream access control based on URL paths libsolv: heap-overflows in resolve_dependencies function django: Denial-of-service possibility in UserAttributeSimilarityValidator django: Potential information disclosure in dictsort template filter django: Potential directory-traversal via Storage.save() django: Possible XSS via '{% debug %}' template tag rubygem-actionpack: information leak between requests rubygem-puma: rubygem-rails: information leak between requests django: Denial-of-service possibility in file uploads sidekiq: WebUI Denial of Service caused by number of days on graph Django: SQL injection in QuerySet.annotate(),aggregate() and extra() Django: SQL injection via QuerySet.explain(options) on PostgreSQL
cpes: cpe:/a:redhat:satellite:6.11::el7 cpe:/a:redhat:satellite:6.11::el8 cpe:/a:redhat:satellite_capsule:6.11::el7 cpe:/a:redhat:satellite_capsule:6.11::el8 cpe:/a:redhat:satellite_maintenance:6.11::el7 cpe:/a:redhat:satellite_maintenance:6.11::el8 cpe:/a:redhat:satellite_utils:6.11::el7 cpe:/a:redhat:satellite_utils:6.11::el8