Red Hat Security Advisory: satellite/iop-vulnerability-engine-rhel9 container image available as a Technology Preview

🔗 CVE IDs covered (5)

📋 Description

🎯 Affected products2

• Red Hat Satellite 6.18
• registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:69ffbd819e8613cc15db70b59f6201c610f4fa084a0b474c7429575a2b15bc30_amd64 as a component of Red Hat Satellite 6.18

✅ Remediation

For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation. Workaround: To mitigate this issue, ensure that applications using GitPython's Repo.clone_from() method to clone from untrusted sources operate within a process environment that does not contain sensitive information as environment variables. Alternatively, implement strict validation and sanitization of all Git repository URLs before they are passed to Repo.clone_from() to prevent the inclusion of environment variable tokens. If the application is a service, a restart may be required for environment variable changes to take effect. Workaround: To mitigate the risk, ensure that applications utilizing GitPython are run within a sandboxed environment with minimal privileges. This limits the potential impact of arbitrary command execution or file truncation if an attacker successfully exploits the vulnerability through an application processing untrusted input. Review applications that interact with GitPython to ensure all input is properly sanitized and validated before being passed to methods such as Repo.archive(), git.ls_remote(), Repo.iter_commits(), or Repo.blame(). Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (12)

• selfhttps://access.redhat.com/errata/RHSA-2026:63334
• externalhttps://access.redhat.com/documentation/en-us/red_hat_satellite/6.18/html/updating_red_hat_satellite/index
• externalhttps://access.redhat.com/security/cve/CVE-2026-67322
• externalhttps://access.redhat.com/security/cve/CVE-2026-67323
• externalhttps://access.redhat.com/security/cve/CVE-2026-67325
• externalhttps://access.redhat.com/security/cve/CVE-2026-69243
• externalhttps://access.redhat.com/security/cve/CVE-2026-69244
• externalhttps://access.redhat.com/security/updates/classification/
• externalhttps://catalog.redhat.com/software/containers/search
• externalhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.18/html/installing_satellite_server_in_a_connected_network_environment/performing-additional-configuration-on-server_satellite#installing-and-configuring-red-hat-lightspeed-in-satellite
• externalhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.18/html/installing_satellite_server_in_a_disconnected_network_environment/performing-additional-configuration#installing-and-configuring-red-hat-lightspeed-in-satellite
• selfhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_63334.json