Red Hat Security Advisory: Technical preview of the satellite/iop-vmaas-rhel9 container image

🔗 CVE IDs covered (3)

📋 Description

🎯 Affected products2

• Red Hat Satellite 6.18
• registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:91f9b41d188efa56f94958a1504b0684298ebaa3204e868a081cf62456502459_amd64 as a component of Red Hat Satellite 6.18

✅ Remediation

For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation. Workaround: To mitigate this issue, ensure that applications using GitPython's Repo.clone_from() method to clone from untrusted sources operate within a process environment that does not contain sensitive information as environment variables. Alternatively, implement strict validation and sanitization of all Git repository URLs before they are passed to Repo.clone_from() to prevent the inclusion of environment variable tokens. If the application is a service, a restart may be required for environment variable changes to take effect. Workaround: To mitigate the risk, ensure that applications utilizing GitPython are run within a sandboxed environment with minimal privileges. This limits the potential impact of arbitrary command execution or file truncation if an attacker successfully exploits the vulnerability through an application processing untrusted input. Review applications that interact with GitPython to ensure all input is properly sanitized and validated before being passed to methods such as Repo.archive(), git.ls_remote(), Repo.iter_commits(), or Repo.blame(). Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (10)

• selfhttps://access.redhat.com/errata/RHSA-2026:63372
• externalhttps://access.redhat.com/documentation/en-us/red_hat_satellite/6.18/html/updating_red_hat_satellite/index
• externalhttps://access.redhat.com/security/cve/CVE-2026-67322
• externalhttps://access.redhat.com/security/cve/CVE-2026-67323
• externalhttps://access.redhat.com/security/cve/CVE-2026-67325
• externalhttps://access.redhat.com/security/updates/classification/
• externalhttps://catalog.redhat.com/software/containers/search
• externalhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.18/html/installing_satellite_server_in_a_connected_network_environment/performing-additional-configuration-on-server_satellite#installing-and-configuring-red-hat-lightspeed-in-satellite
• externalhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.18/html/installing_satellite_server_in_a_disconnected_network_environment/performing-additional-configuration#installing-and-configuring-red-hat-lightspeed-in-satellite
• selfhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_63372.json