Threats Tagged 'cve-2026-44244'

Red Hat Satellite 6.19.0 through 6.19.4 for RHEL 9 contains multiple security vulnerabilities affecting components such as ansible-core, openvox-server, puppetserver, rubygem-jwt, python-aiohttp, and python-gitpython. These vulnerabilities include arbitrary code execution, authentication bypass, denial of service, HTTP request smuggling, information disclosure, and arbitrary file overwrite. Red Hat has released an update (6.19.4 Async Update) addressing these issues.

Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language. For details about this release, refer to the release notes listed in the References section.

CVE-2026-44244 is a high-severity code injection vulnerability in GitPython versions prior to 3.1.49. The issue arises because GitConfigParser.set_value() does not validate newline characters in configuration values, allowing an attacker to inject a crafted core.hooksPath configuration. This injected path can cause Git operations that invoke hooks (such as commit, merge, or checkout) to execute attacker-controlled scripts. The vulnerability has been patched in GitPython version 3.1.49.