Red Hat Satellite 6.15.3 security update addresses five CVEs: CVE-2024-24680 (denial-of-service in Django's intcomma template filter), CVE-2024-27351 (potential regex denial-of-service in django.utils.text.Truncator.words()), CVE-2024-28219 (buffer overflow in python-pillow _imagingcms.c), CVE-2024-27306 (XSS in aiohttp static file handling index pages), and CVE-2024-34064 (jinja2 accepting keys with non-attribute characters). These vulnerabilities affect the system management solution that configures and maintains systems without requiring public Internet access. The update is rated moderate severity by Red Hat Product Security and fixes these issues in Red Hat Satellite 6.15 for RHEL 8.

The vulnerabilities fixed in this update could allow denial-of-service conditions, potential regular expression denial-of-service, buffer overflow leading to possible memory corruption, cross-site scripting attacks, and improper template key acceptance. These issues could affect the stability and security of Red Hat Satellite deployments, potentially impacting system management operations. No known exploits in the wild have been reported at this time.

Red Hat has released updated packages for Red Hat Satellite 6.15.3 that address these vulnerabilities. Users should apply this security update after ensuring all previously released errata are applied. Detailed update instructions are available in the Red Hat Satellite documentation. No additional mitigations are indicated by the vendor advisory.