This advisory covers multiple security vulnerabilities fixed in Red Hat Update Infrastructure (RHUI) 4.11 and Red Hat Satellite 6.15 for RHEL 8. Notable vulnerabilities include CVE-2024-1135, an HTTP request smuggling flaw in python-gunicorn due to improper validation of Transfer-Encoding headers; CVE-2024-26130, a NULL pointer dereference in python-cryptography's pkcs12.serialize_key_and_certificates when called with mismatched certificate and private key and an hmac_hash override; CVE-2024-27306 and CVE-2024-30251 in aiohttp causing XSS and denial-of-service; CVE-2024-4340 in sqlparse leading to denial-of-service via parsing heavily nested lists; multiple denial-of-service and potential SQL injection vulnerabilities in Django; and other issues in jinja2, grpcio, and requests. These vulnerabilities impact the security and stability of RHUI and Satellite components responsible for managing software repositories and content delivery to RHEL systems. The vendor has released updated packages that fix these issues.

The vulnerabilities collectively could allow attackers to perform HTTP request smuggling, cause denial-of-service conditions, trigger NULL pointer dereferences, execute cross-site scripting attacks, and potentially execute SQL injection in affected components. These issues could disrupt content delivery, compromise system stability, or allow unauthorized actions within the management infrastructure. However, no known exploits in the wild have been reported at this time.

Red Hat has released updated packages for RHUI 4.11 and Red Hat Satellite 6.15 that address these vulnerabilities. Users are advised to apply these updates promptly after ensuring all previously released errata relevant to their systems have been applied. Detailed update instructions and documentation are available from Red Hat. No additional mitigation actions are indicated by the vendor beyond applying the official fixes.