This Red Hat Satellite 6.17.10 update addresses multiple Important-rated vulnerabilities across its components, including an authentication bypass in python-pyjwt (CVE-2026-48526), HTTP request smuggling in puppetserver (CVE-2026-2332), and several denial-of-service flaws in python-pillow and rubygem-nokogiri. The advisory includes fixes for CVE-2026-2332, which affects embedded Eclipse Jetty versions 9.4.0 to 9.4.59, 10.0.0 to 10.0.27, 11.0.0 to 11.0.27, 12.0.0 to 12.0.32, and 12.1.0 to 12.1.6, and is resolved in Jetty versions 9.4.60, 10.0.28, 11.0.28, 12.0.33, and 12.1.7. Administrators should apply this Satellite async update after ensuring all previous errata are installed.
Red Hat Product Errata RHSA-2026:50222 - Security Advisory Issued: 2026-08-04 Updated: 2026-08-04 RHSA-2026:50222 - Security Advisory Overview Updated Packages Synopsis Important: Satellite 6.17.10 Async Update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic A new release is now available for Red Hat Satellite 6.17 for RHEL 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity to provide public Internet access to their servers or other client systems. It performs provisioning and configuration management of predefined standard operating environments. Security Fix(es): puppet-agent: Out-of-bounds read & write in RFC 3211 KEK Unwrap (CVE-2025-9230) rubygem-katello: missing repository authorization in content_uploads exposes cross-product content existence (CVE-2026-12515) puppetserver: HTTP request smuggling via chunked extension quoted-string parsing (CVE-2026-2332) python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens (CVE-2026-48526) python-pillow: Pillow: Denial of Service via crafted PCF font data (CVE-2026-54059) python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files (CVE-2026-54060) rubygem-faraday-cookie_jar: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297) python-pillow: Pillow: Denial of Service via crafted BDF font file (CVE-2026-55379) python-pillow: Pillow: Denial of Service via crafted GD 2.x image file (CVE-2026-55380) rubygem-nokogiri: Nokogiri: Denial of Service or Information Disclosure via invalid encoding handling (CVE-2026-57236) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): API endpoint GET /api/host_packages/installed_packages in apidoc is wrong (SAT-48096) Unable to save bookmark report under Hosts > All Hosts > Compliance > Reports (SAT-48150) Update of scap-security-guide-satellite package sources (SAT-48147) Switch Satellite 6.17 to OpenVox (SAT-44867) Katello::Errors::Pulp3Error: nextval: reached maximum value of sequence "container_blobmanifest_id_seq"' during container image sync (SAT-48303) Solution Before applying this update, make sure all previously released errata relevant to your system have been applied. For detailed instructions how to apply this update, refer to: https://docs.redhat.com/en/documentation/red_hat_satellite/6.17/html/updating_red_hat_satellite/index Affected Products Red Hat Satellite 6.17 x86_64 Red Hat Satellite Capsule 6.17 x86_64 Red Hat Enterprise Linux for x86_64 9 x86_64 Fixes BZ - 2396054 - CVE-2025-9230 openssl: Out-of-bounds read & write in RFC 3211 KEK Unwrap BZ - 2458187 - CVE-2026-2332 org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing BZ - 2482734 - CVE-2026-48526 python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens BZ - 2489812 - CVE-2026-12515 katello: missing repository authorization in content_uploads exposes cross-product content existence BZ - 2492252 - CVE-2026-54297 faraday: Faraday: Denial of Service via crafted nested query strings BZ - 2492952 - CVE-2026-57236 nokogiri: Nokogiri: Denial of Service or Information Disclosure via invalid encoding handling BZ - 2497452 - CVE-2026-55379 python-pillow: Pillow: Denial of Service via crafted BDF font file BZ - 2497455 - CVE-2026-55380 python-pillow: Pillow: Denial of Service via crafted GD 2.x image file BZ - 2497464 - CVE-2026-54059 python-pillow: Pillow: Denial of Service via crafted PCF font data BZ - 2497466 - CVE-2026-54060 python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files SAT-48096 - API endpoint GET /api/host_packages/installed_packages in apidoc is wrong [rhn_satellite_6.17] SAT-48147 - Update of scap-security-guide-satellite package sources [rhn_satellite_6.17] SAT-48150 - Unable to save bookmark report under Hosts ? All Hosts ? Compliance ? Reports [rhn_satellite_6.17] SAT-48303 - 'Katello::Errors::Pulp3Error: nextval: reached maximum value of sequence "container_blobmanifest_id_seq"' during container image sync [rhn_satellite_6.17] SAT-44867 - Switch Satellite 6.17 to OpenVox CVEs CVE-2025-9230 CVE-2026-2332 CVE-2026-12515 CVE-2026-48526 CVE-2026-54059 CVE-2026-54060 CVE-2026-54297 CVE-2026-55379 CVE-2026-55380 CVE-2026-57236 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Satellite 6.17 SRPM foreman-installer-3.14.0.11-1.el9sat.src.rpm SHA-256: b02888fe7557d7ec4c9dd3817e88ecd59540264e542a660412d1198c6ea23053 openvox-agent-8.24.1-3.el9sat.src.rpm SHA-256: f2be77937a849612488c606cc9433f75b8656f276bfe430afb41de39c695cfa9 openvox-server-8.14.1-1.el9sat.src.rpm SHA-256: a78d21484629a731d6b66eaca9fb0c7c8a5a489860b3967a42f1b016a727a1a8 python-pillow-12.3.0-1.el9pc.src.rpm SHA-256: 94338a20b1c7d6e87fb2c27aedcd96d952678e377eb207294b01907b59ea4150 python-pulp-container-2.22.10-1.el9pc.src.rpm SHA-256: 480f2369886b41f8e0effc6113a56070f4470f07cb33ba37f9d0787554e59cf4 python-pyjwt-2.13.0-1.el9pc.src.rpm SHA-256: f049d0098fc36ef0e106de687289047f0a431a6b53750b3ea2cea96eb799a460 python-pysequoia-0.1.33-1.el9pc.src.rpm SHA-256: dd5fdf45e0a02eb663ad465631c4a6a425289202fe964e55b8a1c7328949359a rubygem-faraday-1.10.6-1.el9sat.src.rpm SHA-256: 74f638434ff19a9e703f2792f3cb8bc1fc2dc467aecbfd97a7dd648505d03b9f rubygem-foreman_maintain-1.10.6-1.el9sat.src.rpm SHA-256: 1d57fdad97761dd1e690ebb4dd954af2f9faf757b6fd87652ee1feb7055eedf6 rubygem-foreman_openscap-10.2.2-1.el9sat.src.rpm SHA-256: 7d74c9e86f4a19ff7f3e01eee6e7a61e2be96eaf5fd86836487ef81a312970d0 rubygem-katello-4.16.0.18-1.el9sat.src.rpm SHA-256: cb689b7a77a12aeabea9e63d5c9c4af49f94f969af43fd961bedea0ad9fe61da rubygem-nokogiri-1.15.7-3.el9sat.src.rpm SHA-256: eb84e56282b26a78e6875d5187445e01302153082e651af00836f80902a64ad0 satellite-6.17.10-1.el9sat.src.rpm SHA-256: b5feb799b2b09bd833c20c5d9a66ceb0030a4e7c0ccb612fbd41ad66ebf4d8e8 scap-security-guide-satellite-1.0.6-1.el9sat.src.rpm SHA-256: 4c29d812196f98389c918673184a5cefe8308aa2dcdfd00333b8e394b6bc68c5 x86_64 foreman-installer-3.14.0.11-1.el9sat.noarch.rpm SHA-256: 7fa0ae1bdf7f656b9978e7cc07785f997be0c31d7af369b682de0961a37dffea foreman-installer-katello-3.14.0.11-1.el9sat.noarch.rpm SHA-256: 31546a13313348eab42896b5062108a4b8ceb199d24eec8a693dd0b388f43b5a openvox-agent-8.24.1-3.el9sat.x86_64.rpm SHA-256: 0877931b6cfd178af8f547fdbf4f1efd756ed17bcb524408d2389e02dce2ea57 openvox-server-8.14.1-1.el9sat.noarch.rpm SHA-256: 04acd810d2fd8ade1afabecc237f1b77b72d21f933a987ced727aebb77332169 python-pillow-debugsource-12.3.0-1.el9pc.x86_64.rpm SHA-256: d4fbf2b490c024effd596d70775bda1ca1e9d20a16e0835874750ac133ebcda8 python3.11-pillow-12.3.0-1.el9pc.x86_64.rpm SHA-256: 18055e730527134d122723e7edfbe83075ac96924fd002318967ae33d60e89de python3.11-pillow-debuginfo-12.3.0-1.el9pc.x86_64.rpm SHA-256: a286aaf6874f37f28dac7075fd8c4db6d883af322c16547813963c1fb21b090d python3.11-pulp-container-2.22.10-1.el9pc.noarch.rpm SHA-256: bf24d08185af42201a103fcd8213bd8cc595df78f5b041272c7fbb66580fdd8d python3.11-pyjwt-2.13.0-1.el9pc.noarch.rpm SHA-256: e62fd78deed871ca5fdd6dff4dab1c68454e2071eb2c8af10c97f97b187329d8 python3.11-pysequoia-0.1.33-1.el9pc.x86_64.rpm SHA-256: 064eabf15cb50dd14b18845a8114d9a6110a876da3584e35244995ac9452c995 rubygem-faraday-1.10.6-1.el9sat.noarch.rpm SHA-256: f4668f31aa21b758c5d9594c5b514906ed3a1b26b816f83d78c5b7ae6e48f1bf rubygem-foreman_maintain-1.10.6-1.el9sat.noarch.rpm SHA-256: bab8cbfce1074c2a6f8e5efaacf64de7fb270d0c281f1e2a99ff5fcc67bcbd0e rubygem-foreman_openscap-10.2.2-1.el9sat.noarch.rpm SHA-256: fcbbeffc1f8701ea45e30509988b1b069fe105873d0c14da1ed309d0f1bf0f93 rubygem-katello-4.16.0.18-1.el9sat.noarch.rpm SHA-256: 370d06f59bca92faf010d4315c9c871eb3c77e9db8219686c902734172ac58b5 rubygem-nokogiri-1.15.7-3.el9sat.x86_64.rpm SHA-256: fcc2f7cdd663b5f8c277bc06dcdab753a0c9de2ae73e34b6eaa7d01d29c473fe rubygem-nokogiri-debuginfo-1.15.7-3.el9sat.x86_64.rpm SHA-256: 49481bb021bb91666541f55e918c2723f8a9e4f9c1caea77a9f69e2251a56862 rubygem-nokogiri-debugsource-1.15.7-3.el9sat.x86_64.rpm SHA-256: 8c73032291556dd6d6828a3c45fead29db0ce571b83c14270a1e397af594c741 satellite-6.17.10-1.el9sat.noarch.rpm SHA-256: a686429aad14ae480f640e2f0f4136ea008301b973cb951e471231ff8d25fbb3 satellite-cli-6.17.10-1.el9sat.noarch.rpm SHA-256: 1ba286d92748d00e6cd34707863f1afa885ccb30129dc32a68e1cc27d612f63e satellite-common-6.17.10-1.el9sat.noarch.rpm SHA-256: 129c282cb1f8e90b5400718dbefcd18540482c57798887af478f6e004e7f8025 satellite-obsolete-packages-6.17.10-1.el9sat.noarch.rpm SHA-256: 22849819ad7f5a8a5676b8617ca9357f88a7b6bb4fc668080a16c284ff7ca6cb scap-security-guide-satellite-1.0.6-1.el9sat.noarch.rpm SHA-256: af0de4d108486768dc8bc6a63a0845de7ca8c9542eb13d6876afd1bae3bc843d Red Hat Satellite Capsule 6.17 SRPM foreman-installer-3.14.0.11-1.el9sat.src.rpm SHA-256: b02888fe7557d7ec4c9dd3817e88ecd59540264e542a660412d1198c6ea23053 openvox-agent-8.24.1-3.el9sat.src.rpm SHA-256: f2be77937a849612488c606cc9433f75b8656f276bfe430afb41de39c695cfa9 openvox-server-8.14.1-1.el9sat.src.rpm SHA-256: a78d21484629a731d6b66eaca9fb0c7c8a5a489860b3967a42f1b016a727a1a8 python-pillow-12.3.0-1.el9pc.src.rpm SHA-256: 94338a20b1c7d6e87fb2c27aedcd96d952678e377eb207294b01907b59ea4150 python-pulp-container-2.22.10-1.el9pc.src.rpm SHA-256: 480f2369886b41f8e0effc6113a56070f4470f07cb