Red Hat Security Advisory: Satellite 6.17.8 Async Update
Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity to provide public Internet access to their servers or other client systems. It performs provisioning and configuration management of predefined standard operating environments. Security Fix(es): * python-pillow: Pillow: Out-of-bounds Write via Specially Crafted PSD Image (CVE-2026-25990) * candlepin: mchange-commons-java: Arbitrary code execution via JNDI dereferencing of crafted objects (CVE-2026-27727) * python-markdown: denial of service via malformed HTML-like sequences (CVE-2025-69534) * python-pyOpenSSL: DTLS cookie callback buffer overflow (CVE-2026-27459) * rubygem-activesupport: Active Support: Denial of Service via large scientific notation strings (CVE-2026-33176) Bug Fix(es): * Satellite manifest consumer profile cert and key found in satellite client rhsm cache (SAT-43920) * All communication should happen only over https during global registration execution (SAT-43921) * Impossible to generate registration command via REST API in isolated networks managed by external capsules (SAT-43922) * Errata applicability and Refresh applicability tasks for RHEL 7 hosts runs dnf command. (SAT-43923) * BIOS info is not populated in All hosts page and in Host Details tab (SAT-43925) * Executing the 'katello::clean_backend_objects' rake task takes a long time to complete (SAT-43926) * Puppet fact parser can't create OS entry blocking Satellite leapp upgrades (SAT-43928) * No repositories available through subscriptions on a cloud-instance host after registering it to Red Hat Satellite using global registration method (SAT-43929) * Proxy password shown in clear text in the Overview page of Virt-who Configuration (SAT-43931) * Non-admin users on Satellite with viewer role, unable to see the hostgroup. (SAT-44039)
AI Analysis
Technical Summary
This Red Hat Satellite security advisory (RHSA-2026:14873) fixes five security vulnerabilities: CVE-2025-69534 (denial of service via malformed HTML-like sequences in python-markdown), CVE-2026-25990 (out-of-bounds write in python-pillow via specially crafted PSD images), CVE-2026-27727 (arbitrary code execution via JNDI dereferencing in candlepin's mchange-commons-java), CVE-2026-27459 (DTLS cookie callback buffer overflow in python-pyOpenSSL), and CVE-2026-33176 (denial of service via large scientific notation strings in rubygem-activesupport). The advisory also includes multiple bug fixes improving Satellite functionality and security. The update is for Red Hat Satellite 6.17 for RHEL 9, affecting versions >=6.17.0 and <6.17.8.
Potential Impact
Successful exploitation of these vulnerabilities could lead to denial of service conditions, out-of-bounds memory writes, arbitrary code execution, and buffer overflows within the affected components of Red Hat Satellite. This could impact system stability, security, and potentially allow attackers to execute arbitrary code. The advisory does not report known exploits in the wild at this time.
Mitigation Recommendations
A fixed version, Red Hat Satellite 6.17.8, is available and should be applied to remediate these vulnerabilities. Before applying this update, ensure all previously released errata relevant to your system have been applied. Follow the official Red Hat Satellite update documentation for detailed instructions: https://docs.redhat.com/en/documentation/red_hat_satellite/6.17/html/updating_red_hat_satellite/index. No additional mitigation steps are indicated by the vendor advisory.
Red Hat Security Advisory: Satellite 6.17.8 Async Update
Description
Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity to provide public Internet access to their servers or other client systems. It performs provisioning and configuration management of predefined standard operating environments. Security Fix(es): * python-pillow: Pillow: Out-of-bounds Write via Specially Crafted PSD Image (CVE-2026-25990) * candlepin: mchange-commons-java: Arbitrary code execution via JNDI dereferencing of crafted objects (CVE-2026-27727) * python-markdown: denial of service via malformed HTML-like sequences (CVE-2025-69534) * python-pyOpenSSL: DTLS cookie callback buffer overflow (CVE-2026-27459) * rubygem-activesupport: Active Support: Denial of Service via large scientific notation strings (CVE-2026-33176) Bug Fix(es): * Satellite manifest consumer profile cert and key found in satellite client rhsm cache (SAT-43920) * All communication should happen only over https during global registration execution (SAT-43921) * Impossible to generate registration command via REST API in isolated networks managed by external capsules (SAT-43922) * Errata applicability and Refresh applicability tasks for RHEL 7 hosts runs dnf command. (SAT-43923) * BIOS info is not populated in All hosts page and in Host Details tab (SAT-43925) * Executing the 'katello::clean_backend_objects' rake task takes a long time to complete (SAT-43926) * Puppet fact parser can't create OS entry blocking Satellite leapp upgrades (SAT-43928) * No repositories available through subscriptions on a cloud-instance host after registering it to Red Hat Satellite using global registration method (SAT-43929) * Proxy password shown in clear text in the Overview page of Virt-who Configuration (SAT-43931) * Non-admin users on Satellite with viewer role, unable to see the hostgroup. (SAT-44039)
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This Red Hat Satellite security advisory (RHSA-2026:14873) fixes five security vulnerabilities: CVE-2025-69534 (denial of service via malformed HTML-like sequences in python-markdown), CVE-2026-25990 (out-of-bounds write in python-pillow via specially crafted PSD images), CVE-2026-27727 (arbitrary code execution via JNDI dereferencing in candlepin's mchange-commons-java), CVE-2026-27459 (DTLS cookie callback buffer overflow in python-pyOpenSSL), and CVE-2026-33176 (denial of service via large scientific notation strings in rubygem-activesupport). The advisory also includes multiple bug fixes improving Satellite functionality and security. The update is for Red Hat Satellite 6.17 for RHEL 9, affecting versions >=6.17.0 and <6.17.8.
Potential Impact
Successful exploitation of these vulnerabilities could lead to denial of service conditions, out-of-bounds memory writes, arbitrary code execution, and buffer overflows within the affected components of Red Hat Satellite. This could impact system stability, security, and potentially allow attackers to execute arbitrary code. The advisory does not report known exploits in the wild at this time.
Mitigation Recommendations
A fixed version, Red Hat Satellite 6.17.8, is available and should be applied to remediate these vulnerabilities. Before applying this update, ensure all previously released errata relevant to your system have been applied. Follow the official Red Hat Satellite update documentation for detailed instructions: https://docs.redhat.com/en/documentation/red_hat_satellite/6.17/html/updating_red_hat_satellite/index. No additional mitigation steps are indicated by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:14873
- Cve Count
- 5
- Additional Cves
- ["CVE-2026-25990","CVE-2026-27459","CVE-2026-27727","CVE-2026-33176"]
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a160980e29bf47b5064d07a
Added to database: 05/26/2026, 20:58:40 UTC
Last enriched: 08/12/2026, 19:47:44 UTC
Last updated: 09/14/2026, 10:01:28 UTC
Views: 132
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.