Red Hat Security Advisory: Satellite 6.19.4 Async Update

Red Hat Satellite 6.19.0 through 6.19.4 for RHEL 9 is affected by multiple security vulnerabilities across several components. These include argument injection in ansible-core leading to arbitrary code execution (CVE-2026-11332, CVE-2026-16493), arbitrary code execution via PolymorphicTypeValidator bypass in openvox-server and puppetserver (CVE-2026-54512), authentication bypass in rubygem-jwt (CVE-2026-45363), denial of service and HTTP request smuggling in python-aiohttp (CVE-2026-69244, CVE-2026-69243), arbitrary code execution via untrusted input in python-aiohttp (CVE-2026-34993), information disclosure in openvox-server (CVE-2026-10051), and multiple arbitrary code execution, file overwrite, and information disclosure vulnerabilities in python-gitpython (CVE-2026-42215, CVE-2026-42284, CVE-2026-44244, CVE-2026-73620, CVE-2026-73622, CVE-2026-73623, CVE-2026-73624, CVE-2026-73625, CVE-2026-76218, CVE-2026-76219, CVE-2026-76220, CVE-2026-76221, CVE-2026-76222). Red Hat has released version 6.19.4 to address these vulnerabilities.

The vulnerabilities collectively allow attackers to execute arbitrary code, bypass authentication mechanisms, cause denial of service conditions, perform HTTP request smuggling, disclose sensitive information, and overwrite arbitrary files within affected Red Hat Satellite deployments. These impacts can compromise system integrity, confidentiality, and availability if exploited.

Red Hat has released an official update in Red Hat Satellite version 6.19.4 that addresses all listed vulnerabilities. Users should apply this update promptly after ensuring all previously released errata relevant to their system have been applied. Detailed update instructions are available from Red Hat's official documentation. No additional mitigations are specified beyond applying the official fix.