Red Hat Security Advisory: Satellite 6.17.11 Async Update

This advisory covers a set of security vulnerabilities affecting Red Hat Satellite 6.17 versions >=6.17.0 and <6.17.11. The vulnerabilities include: arbitrary code execution via jackson-databind PolymorphicTypeValidator bypass (CVE-2026-54512), denial of service in jackson-core async JSON parser (CVE-2026-68494), denial of service and arbitrary code execution in AIOHTTP (CVE-2026-69244, CVE-2026-34993), HTTP request smuggling in AIOHTTP (CVE-2026-69243), authentication bypass in ruby-jwt (CVE-2026-45363), information disclosure in Eclipse Jetty due to retained HTTP/1.1 trailers (CVE-2026-10051), and argument injection leading to arbitrary code execution in ansible-core (CVE-2026-11332, CVE-2026-16493). The update to Satellite 6.17.11 includes fixes for these vulnerabilities and several upgrade/migration bugs. The vendor advisory rates the update as Important and provides detailed remediation instructions.

Successful exploitation of these vulnerabilities could allow attackers to execute arbitrary code, cause denial of service conditions, bypass authentication mechanisms, perform HTTP request smuggling attacks, or disclose sensitive information. These impacts affect the confidentiality, integrity, and availability of systems managed by Red Hat Satellite 6.17 prior to 6.17.11. The vulnerabilities span multiple components, increasing the attack surface. No known exploits in the wild are reported at this time.

A fixed version, Red Hat Satellite 6.17.11, is available and addresses all listed vulnerabilities. Users should apply this update after ensuring all previously released errata relevant to their system have been applied. Detailed update instructions are available from Red Hat's official documentation. No additional mitigations are specified or required beyond applying the official update.