This advisory covers security fixes in Red Hat Satellite 6.16.3 for RHEL 8 and 9. The fixes address a sandbox breakout vulnerability in the python-jinja2 package (CVE-2024-56326) caused by indirect reference to the format method, and a potential denial-of-service vulnerability in python-django related to IPv6 validation (CVE-2024-56374). Red Hat Satellite enables organizations to manage systems without requiring public Internet access. The update mitigates these vulnerabilities by providing patched packages. Users should ensure all prior errata are applied before upgrading. The advisory does not provide a CVSS score but rates the impact as moderate.

The vulnerabilities fixed in this update could allow sandbox breakout via Jinja2 template processing and denial-of-service conditions through IPv6 validation in Django. These issues affect the integrity and availability of the Red Hat Satellite system management platform. Exploitation could disrupt provisioning and configuration management operations. However, there are no known exploits in the wild currently reported. The overall security impact is rated moderate by Red Hat.

Red Hat advises users of Red Hat Satellite 6.16 for RHEL 8 and 9 to upgrade to the updated packages that include these security fixes. Before applying this update, users should ensure all previously released errata relevant to their system have been applied. Detailed upgrade instructions are available in the Red Hat Satellite documentation. Since this is an on-premises product, remediation requires manual application of the update by administrators. No alternative mitigations or workarounds are specified in the advisory.