Red Hat Product Errata RHSA-2026:50221 - Security Advisory Issued: 2026-08-04 Updated: 2026-08-04 RHSA-2026:50221 - Security Advisory Overview Updated Packages Synopsis Important: Satellite 6.19.3 Async Update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic A new release is now available for Red Hat Satellite 6.19 for RHEL 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity to provide public Internet access to their servers or other client systems. It performs provisioning and configuration management of predefined standard operating environments. Security Fix(es): rubygem-katello: missing repository authorization in content_uploads exposes cross-product content existence (CVE-2026-12515) openvox-server: HTTP request smuggling via chunked extension quoted-string parsing (CVE-2026-2332) rubygem-faraday: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297) rubygem-faraday_middleware: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297) rubygem-faraday-cookie_jar: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297) rubygem-faraday-em_ http: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297) rubygem-faraday-em_synchrony: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297) rubygem-faraday-excon: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297) rubygem-faraday-httpclient: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297) rubygem-faraday-multipart: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297) rubygem-faraday-net_ http: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297) rubygem-faraday-net_http_persistent: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297) rubygem-faraday-patron: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297) rubygem-faraday-rack: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297) rubygem-faraday-retry: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297) rubygem-nokogiri: Nokogiri: Denial of Service or Information Disclosure via invalid encoding handling (CVE-2026-57236) python-pillow: Pillow: Denial of Service via crafted PCF font data (CVE-2026-54059) python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files (CVE-2026-54060) python-pillow: Pillow: Denial of Service via crafted BDF font file (CVE-2026-55379) python-pillow: Pillow: Denial of Service via crafted GD 2.x image file (CVE-2026-55380) Solution Before applying this update, make sure all previously released errata relevant to your system have been applied. For detailed instructions how to apply this update, refer to: https://access.redhat.com/documentation/en-us/red_hat_satellite/6.19/html/updating_red_hat_satellite/index Affected Products Red Hat Satellite 6.19 x86_64 Red Hat Satellite Capsule 6.19 x86_64 Red Hat Enterprise Linux for x86_64 9 x86_64 Fixes SAT-42697 - Sync memory consumption too high in pathological cases SAT-47597 - Non-default umask breaks IoP assets directory permissions SAT-47598 - Unable to save bookmark report under Hosts ? All Hosts ? Compliance ? Reports SAT-47599 - Deployment to vCenter Broken - Post 6.18.3 Update from 6.18.1 SAT-47601 - IoP host details Recommendations and Vulnerabilities tabs don't work with breadcrumb switcher SAT-47602 - Update of scap-security-guide-satellite package sources SAT-47604 - Propagate error data from services by foreman_rh_cloud request forwarder SAT-47605 - Inventory upload task fails with "can't find record with friendly id: 'satellite.example.com'" when base host record is missing CVEs CVE-2026-2332 CVE-2026-12515 CVE-2026-54059 CVE-2026-54060 CVE-2026-54297 CVE-2026-55379 CVE-2026-55380 CVE-2026-57236 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Satellite 6.19 SRPM foreman-3.18.0.8-1.el9sat.src.rpm SHA-256: 6d93d444d39a6e3a9376c3e0aeb22de6b961cdf60eca858f77d9fe3e1e5e5a1d foreman-installer-3.18.0.2-1.el9sat.src.rpm SHA-256: 0c964f7d639b5d82f98b56df77c0bf943ce0f948c7d15e058aa87ac05736e672 openvox-server-8.14.1-1.el9sat.src.rpm SHA-256: a78d21484629a731d6b66eaca9fb0c7c8a5a489860b3967a42f1b016a727a1a8 python3.12-pillow-12.3.0-1.el9pc.src.rpm SHA-256: 51287d8d2ec4216503ea992c2758fa5e7a7295910c3410f46cee258002311574 python3.12-pulp-rpm-3.32.10-1.el9pc.src.rpm SHA-256: a7a0f193f61cb305ba224f5c634f55f5aa8071e02f9d9f3a5e0b11785c4e0ae2 rubygem-faraday-1.10.6-1.el9sat.src.rpm SHA-256: 74f638434ff19a9e703f2792f3cb8bc1fc2dc467aecbfd97a7dd648505d03b9f rubygem-foreman_openscap-12.1.2-1.el9sat.src.rpm SHA-256: c92d3a7ffa5d054499965201d90cabc681c4d95647f28558aac94a5e89f1fc53 rubygem-foreman_rh_cloud-13.2.10-1.el9sat.src.rpm SHA-256: 8625dc22b57aa28ae938750ec116bac961e390b588d9ae18643e4f31329eab6b rubygem-katello-4.20.0.7-1.el9sat.src.rpm SHA-256: 53320df0746a19cedb6597d8e6d9ba1c2bbf2f0e97422049e841d98f288e7487 rubygem-nokogiri-1.17.2-3.el9sat.src.rpm SHA-256: 35a08cdbd7ce4b1f0737218c7d2676c5bedf53a84fdbb0ec8e8b007002618d1b satellite-6.19.3-1.el9sat.src.rpm SHA-256: 74bbbc5ad96edd14768d592dd8b2ab0061c3adbbbb958ee8b061a20ad0d3e9d7 scap-security-guide-satellite-1.0.6-1.el9sat.src.rpm SHA-256: 4c29d812196f98389c918673184a5cefe8308aa2dcdfd00333b8e394b6bc68c5 x86_64 foreman-3.18.0.8-1.el9sat.noarch.rpm SHA-256: 85f46f8931ac6f817aedc99e9c6b599fad6a87f84682bec00b65123d1a1f36f7 foreman-cli-3.18.0.8-1.el9sat.noarch.rpm SHA-256: 0c1580f5a756d5b0557dbb4c21f55bdf863b9dd8bdc3a30dff5b1659a0b4de00 foreman-debug-3.18.0.8-1.el9sat.noarch.rpm SHA-256: 69981d5b9961f2af1727a8851cd6fa565d912d4779f88462f6a62d0277184213 foreman-dynflow-sidekiq-3.18.0.8-1.el9sat.noarch.rpm SHA-256: 5ec34af2a4aec012c276f250971a2742e18d04a2ce4fa6088c957ae68ace12af foreman-ec2-3.18.0.8-1.el9sat.noarch.rpm SHA-256: b3462d6dfab101b4e9af7c5c9ca42e8dd68d96e1eff122a0aa5ca3a59b4ee499 foreman-installer-3.18.0.2-1.el9sat.noarch.rpm SHA-256: 6b2f0502a4dd70a5f8c1b3f2b31610a35525ea20a1b7f3b3792a3b84863098ba foreman-installer-katello-3.18.0.2-1.el9sat.noarch.rpm SHA-256: 529d9fd807c9b4d44c9a13ad73c4d0a430853de48b4b8be67f8f18eec29cb2a8 foreman-journald-3.18.0.8-1.el9sat.noarch.rpm SHA-256: b43c5ee60bf3216d8fc20369b9d259cc8a73ca230894ae9517cfaeed09342218 foreman-libvirt-3.18.0.8-1.el9sat.noarch.rpm SHA-256: c80838bc4613025fdf5c24161c55fdabac56697169cd38e1963b251478deb907 foreman-openstack-3.18.0.8-1.el9sat.noarch.rpm SHA-256: e0e2b2c2d5ae05540a91af08ffacba8579c688fb787a77c859e71f2d62af3c8d foreman-pcp-3.18.0.8-1.el9sat.noarch.rpm SHA-256: 89638c4e0c8686f281f055fae2fa14621675627ccf1619ca64ee1ce519dd260b foreman-postgresql-3.18.0.8-1.el9sat.noarch.rpm SHA-256: b42c93719e6e92a22c2008a32c10f3f78d1ddcd02ed14ed90c454f32d1d0039b foreman-redis-3.18.0.8-1.el9sat.noarch.rpm SHA-256: 71938bbafbbc74a81fd0ca5951dadea5cd51012bec7c390550197cd91ecd3a58 foreman-service-3.18.0.8-1.el9sat.noarch.rpm SHA-256: 03306dcf6a3302cf5556d8ee4117c1ecc2adcd541e598d882a4edd307d1b9274 foreman-telemetry-3.18.0.8-1.el9sat.noarch.rpm SHA-256: 678e435efe5deadabc17e283ae16c101c9817426bd871f0e83ddcf292e3f2a39 foreman-vmware-3.18.0.8-1.el9sat.noarch.rpm SHA-256: d87dd8c679abb1a7a717034efc77f11694d74b3fef930d2e69b5ac5174c66186 openvox-server-8.14.1-1.el9sat.noarch.rpm SHA-256: 04acd810d2fd8ade1afabecc237f1b77b72d21f933a987ced727aebb77332169 python3.12-pillow-12.3.0-1.el9pc.x86_64.rpm SHA-256: add91eb682ee7b87fbdeb4a918c9cceae4f08f4e8dd64669e54eaca9837dc0c6 python3.12-pillow-debuginfo-12.3.0-1.el9pc.x86_64.rpm SHA-256: 56a4b6ace5594372e84e986d665bb0a9728f9483ba3e14eb3507165e3339186c python3.12-pillow-debugsource-12.3.0-1.el9pc.x86_64.rpm SHA-256: 47f508bc7f0a940e7425e19c60610caa76950b702ab2ad67603626b1f0e50665 python3.12-pulp-rpm-3.32.10-1.el9pc.noarch.rpm SHA-256: acd48832ed01310d03f1e95597439c6b49fdf59abaa133638204bad0faecc1fb rubygem-faraday-1.10.6-1.el9sat.noarch.rpm SHA-256: f4668f31aa21b758c5d9594c5b514906ed3a1b26b816f83d78c5b7ae6e48f1bf rubygem-foreman_openscap-12.1.2-1.el9sat.noarch.rpm SHA-256: 9d4e7c5ef25b9faae94446986a35ace40e42dea063da4afc9d2fabe5d223fc0f rubygem-foreman_rh_cloud-13.2.10-1.el9sat.noarch.rpm SHA-256: f65de025bad40f8283fc32176f32baf91181980da4851791388922d1af70cd0a rubygem-katello-4.20.0.7-1.el9sat.noarch.rpm SHA-256: 077898097dd6dd3751e70824cd789f63ad9c3504bc62df9d6d40dbb613f6994f rubygem-nokogiri-1.17.2-3.el9sat.x86_64.rpm SHA-256: aadd2a0a50e42257f417893f6832a6922c76895bb2625166af9838a80c25fc0a rubygem-nokogiri-debuginfo-1.17.2-3.el9sat.x86_64.rpm SHA-256: b83fd34d03fa6e4250ab6442174aac2ad5137eb7bd90db2afaed5c11c3962a7c rubygem-nokogiri-debugsource-1.17.2-3.el9sat.x86_64.rpm SHA-256: 9a50f03de028733a805e226df458eba4c1839b2ea2f0c8235f0b645c52a28bea satellite-6.19.3-1.el9sat.noarch.rpm SHA-256: 4c6b23a1797752248094f537419f5a4f96de83f6640a94029540b735c3072eed satellite-cli-6.19.3-1.el9sat.noarch.rpm SHA-256: 81ac47bf09ede4acb392b667f803846ec647b00020dfbf843d1704746b2d4e98 satellite-common-6.19.3-1.el9sat.noarch.rpm SHA-256: 562e4be215e45235674ce9ba37a34a1755c6af0622a35e95f167c8c4cdb5c739 satellite-obsolete-packages-6.19.3-1.el9sat.noarch.rpm SHA-256: 88e5515ecf5b2cd48e3bfceff4ab0ff8a8772cbaf5d7094fbfa408c3072c9da4 scap-security-guide-satellite-1.0.6-1.el9sat.noarch.rpm SHA-256: af0de4d108486768dc8bc6a63a0845de7ca8c9542eb13d6876afd1bae3bc843d Red Hat Satellite Capsule 6.