This security update for Red Hat Satellite 6.19 addresses five vulnerabilities, including a critical (CVSS 9.0) directory traversal in python3.12-pulpcore (CVE-2026-12701) and multiple denial-of-service and privilege escalation flaws in yggdrasil-worker-forwarder. The yggdrasil-worker-forwarder component is affected by CVE-2026-33811 (CVSS 7.5), which impacts Go versions prior to 1.25.10 and versions 1.26.0 through 1.26.2. The fix is included in the Satellite 6.19.2.1 Async Update, requiring administrators to apply the released patches.
Red Hat Product Errata RHSA-2026:42240 - Security Advisory Issued: 2026-07-20 Updated: 2026-07-20 RHSA-2026:42240 - Security Advisory Overview Updated Packages Synopsis Important: Satellite 6.19.2.1 Async Update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic A new release is now available for Red Hat Satellite 6.19 for RHEL 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity to provide public Internet access to their servers or other client systems. It performs provisioning and configuration management of predefined standard operating environments. Security Fix(es): python3.12-pulpcore: pulpcore: relative_path_validator bypass via directory traversal in FilesystemExport (CVE-2026-12701) yggdrasil-worker-forwarder: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145) yggdrasil-worker-forwarder: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) yggdrasil-worker-forwarder: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) yggdrasil-worker-forwarder: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186) Solution Before applying this update, make sure all previously released errata relevant to your system have been applied. For detailed instructions how to apply this update, refer to: https://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/updating_red_hat_satellite/index Affected Products Red Hat Satellite 6.19 x86_64 Red Hat Satellite Capsule 6.19 x86_64 Red Hat Enterprise Linux for x86_64 9 x86_64 Fixes (none) CVEs CVE-2026-12701 CVE-2026-27145 CVE-2026-33186 CVE-2026-33811 CVE-2026-39821 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Satellite 6.19 SRPM python3.12-pulpcore-3.85.15-5.el9pc.src.rpm SHA-256: 99667f6cbe4c4b51d1b50054cfb4dc43704fdb016944bba9ef312199a002230f satellite-6.19.2.1-1.el9sat.src.rpm SHA-256: 12398132332109e66c17d7619c9bef30a8fb3f1e752e7340fab5aaecc9a54873 yggdrasil-worker-forwarder-0.0.4-1.el9sat.src.rpm SHA-256: 387ba25ee571ab79cedbe84491b639b0b98ffee8afeee5345159fba35dff0567 x86_64 python3.12-pulpcore-3.85.15-5.el9pc.noarch.rpm SHA-256: b4097d5f080a7d590212548ee4e098d68070bafa89e679cba551ab937b153b3e satellite-6.19.2.1-1.el9sat.noarch.rpm SHA-256: 291dbd8d889b6ec576ae6e74f768a27dd18c896b41d7b7822b3f82e3eff24d71 satellite-cli-6.19.2.1-1.el9sat.noarch.rpm SHA-256: 38dc4727888ebb5a84df60b4ee59ec3f444fa70cd9141471e5cf13a9a9861d0b satellite-common-6.19.2.1-1.el9sat.noarch.rpm SHA-256: 2bc92d3912ea4517091c417ca434d7ba9389af12a6dfad46a29afd21631eb668 satellite-obsolete-packages-6.19.2.1-1.el9sat.noarch.rpm SHA-256: 628679633a00794abaa0f6b2e28446016e91dffff30cc69a64e797e9b6ef69c1 yggdrasil-worker-forwarder-0.0.4-1.el9sat.x86_64.rpm SHA-256: 85f1a904da0474f9c0a22fcc78ca237be1fece967d10f0ca86ba1487b9244daf Red Hat Satellite Capsule 6.19 SRPM python3.12-pulpcore-3.85.15-5.el9pc.src.rpm SHA-256: 99667f6cbe4c4b51d1b50054cfb4dc43704fdb016944bba9ef312199a002230f satellite-6.19.2.1-1.el9sat.src.rpm SHA-256: 12398132332109e66c17d7619c9bef30a8fb3f1e752e7340fab5aaecc9a54873 x86_64 python3.12-pulpcore-3.85.15-5.el9pc.noarch.rpm SHA-256: b4097d5f080a7d590212548ee4e098d68070bafa89e679cba551ab937b153b3e satellite-capsule-6.19.2.1-1.el9sat.noarch.rpm SHA-256: 430669baf40d7d4a414fc697c6facb3cff24f90c17a8384d047be03c37ad5219 satellite-common-6.19.2.1-1.el9sat.noarch.rpm SHA-256: 2bc92d3912ea4517091c417ca434d7ba9389af12a6dfad46a29afd21631eb668 satellite-obsolete-packages-6.19.2.1-1.el9sat.noarch.rpm SHA-256: 628679633a00794abaa0f6b2e28446016e91dffff30cc69a64e797e9b6ef69c1 Red Hat Enterprise Linux for x86_64 9 SRPM satellite-6.19.2.1-1.el9sat.src.rpm SHA-256: 12398132332109e66c17d7619c9bef30a8fb3f1e752e7340fab5aaecc9a54873 x86_64 satellite-cli-6.19.2.1-1.el9sat.noarch.rpm SHA-256: 38dc4727888ebb5a84df60b4ee59ec3f444fa70cd9141471e5cf13a9a9861d0b The Red Hat security contact is secalert@redhat.com . More contact details at https://access.redhat.com/security/team/contact/ .