(RHSA-2019:1222) Moderate: Satellite 6.5 Release

Red Hat Satellite is a systems management tool for Linux-based infrastructure.
It allows for provisioning, remote management, and monitoring of multiple Linux deployments with a single centralized tool.

Security Fix(es):

• RESTEasy: Abuse of GZIPInterceptor in RESTEasy can lead to denial of service attack (CVE-2016-6346)

• pulp: Improper path parsing leads to overwriting of iso repositories (CVE-2018-10917)

• foreman: Persisted XSS on all pages that use breadcrumbs (CVE-2018-14664)

• foreman: stored XSS in success notification after entity creation (CVE-2018-16861)

• katello: stored XSS in subscriptions and repositories pages (CVE-2018-16887)

• candlepin: credentials exposure through log files (CVE-2019-3891)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

This update also fixes several bugs and adds various enhancements. Documentation for these changes is available from the Release Notes document linked to in the References section.