Red Hat Satellite 6.16.0 through versions before 6.16.3 for RHEL 8 and 9 includes security flaws in bundled components. Specifically, python-jinja2 has a sandbox breakout vulnerability via indirect reference to the format method (CVE-2024-56326), and python-django has a potential denial-of-service vulnerability in IPv6 validation (CVE-2024-56374). These vulnerabilities are addressed in the updated Red Hat Satellite 6.16.3 release. The advisory recommends applying this update after ensuring all previous errata have been applied.

The vulnerabilities could allow an attacker to escape the sandbox in Jinja2 templates, potentially leading to unauthorized code execution or information disclosure. The Django IPv6 validation flaw could be exploited to cause denial-of-service conditions. The overall security impact is rated moderate by Red Hat Product Security.

Red Hat has released Red Hat Satellite 6.16.3 which includes fixes for these vulnerabilities. Users should upgrade to version 6.16.3 after applying all previously released errata relevant to their systems. Detailed update instructions are available in the Red Hat Satellite documentation. No additional mitigations are indicated beyond applying the official update.