Threats Tagged 'cve-2026-42284'

Red Hat Satellite 6.19.0 through 6.19.4 for RHEL 9 contains multiple security vulnerabilities affecting components such as ansible-core, openvox-server, puppetserver, rubygem-jwt, python-aiohttp, and python-gitpython. These vulnerabilities include arbitrary code execution, authentication bypass, denial of service, HTTP request smuggling, information disclosure, and arbitrary file overwrite. Red Hat has released an update (6.19.4 Async Update) addressing these issues.

Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language. For details about this release, refer to the release notes listed in the References section.

CVE-2026-42284 is a high-severity vulnerability in GitPython prior to version 3.1.47. It involves improper neutralization of argument delimiters in the _clone() function, allowing crafted multi_options strings to bypass validation and inject additional Git command arguments. This can lead to execution of attacker-controlled Git hooks during repository cloning. The issue has been fixed in GitPython version 3.1.47.