Red Hat Security Advisory: General availability of the satellite/iop-advisor-backend-rhel9 container image
🔗 CVE IDs covered (5)
📋 Description
CVE-2025-14550 — Django: Django: Denial of Service via crafted request with duplicate headers CVE-2026-1207 — Django: Django: SQL Injection via RasterField band index parameter CVE-2026-1285 — Django: Django: Denial of Service via crafted HTML inputs CVE-2026-1287 — Django: Django: SQL Injection via crafted column aliases CVE-2026-1312 — Django: Django: SQL injection via crafted column aliases in QuerySet.order_by()
🎯 Affected products2
- Red Hat Satellite 6.18
- registry.redhat.io/satellite/iop-advisor-backend-rhel9@sha256:563d17f7250c9a5ccb9f7213332b0a8e0b876e8e4e9814a7f397e51972c60a2c_amd64 as a component of Red Hat Satellite 6.18
✅ Remediation
For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, applications utilizing Django should avoid processing untrusted HTML content through the `django.utils.text.Truncator.chars()` and `Truncator.words()` methods with `html=True`, or the `truncatechars_html` and `truncatewords_html` template filters. Restrict the use of these functions to only trusted inputs where the HTML structure is controlled and validated.
🔗 References (12)
- selfhttps://access.redhat.com/errata/RHSA-2026:6291
- externalhttps://access.redhat.com/documentation/en-us/red_hat_satellite/6.18/html/updating_red_hat_satellite/index
- externalhttps://access.redhat.com/security/cve/CVE-2025-14550
- externalhttps://access.redhat.com/security/cve/CVE-2026-1207
- externalhttps://access.redhat.com/security/cve/CVE-2026-1285
- externalhttps://access.redhat.com/security/cve/CVE-2026-1287
- externalhttps://access.redhat.com/security/cve/CVE-2026-1312
- externalhttps://access.redhat.com/security/updates/classification/
- externalhttps://catalog.redhat.com/software/containers/search
- externalhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.18/html/installing_satellite_server_in_a_connected_network_environment/performing-additional-configuration-on-server_satellite#installing-and-configuring-red-hat-lightspeed-in-satellite
- externalhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.18/html/installing_satellite_server_in_a_disconnected_network_environment/performing-additional-configuration#installing-and-configuring-red-hat-lightspeed-in-satellite
- selfhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_6291.json