Red Hat Update Infrastructure 4 For Cloud Providers
Monthly
Arbitrary file write in pulpcore's FilesystemExport feature allows an authenticated administrator to escape the intended export directory via directory-traversal sequences embedded in a user-controlled relative_path. Because the exported file content is also attacker-supplied (an uploaded artifact), the flaw lets a privileged user plant or overwrite arbitrary files anywhere the Pulp service user can write, enabling service compromise or broader host takeover. Rated CVSS 9.0 and reported by Red Hat, it affects pulpcore as embedded in Ansible Automation Platform 2, Satellite 6, and Red Hat Update Infrastructure 4/5; there is no public exploit identified at time of analysis.
Denial of service in libsolv's PGP signature verification (solv_pgpvrfy) allows remote attackers to crash automated package and repository processing by supplying a crafted Ed25519 signature. The flaw is a stack-based buffer overflow (CWE-121) triggered when the EdDSA 's' MPI is copied into a fixed 64-byte stack buffer using an attacker-controlled mismatched length. It affects the libsolv dependency solver embedded in Red Hat Enterprise Linux 7/8/9/10, OpenShift, Satellite, RHUI, openSUSE/SUSE, Ubuntu and Debian; no public exploit identified at time of analysis and it is not in CISA KEV.
Heap buffer overflow in libsolv allows local attackers to corrupt memory when a vulnerable application processes a maliciously crafted .solv repository metadata file. The flaw stems from insufficient input validation during decompression of attacker-controlled data, enabling information disclosure, control-flow alteration, or denial of service across multiple Red Hat Enterprise Linux releases and SUSE distributions. SSVC marks exploitation as PoC-level with total technical impact, while EPSS remains very low at 0.01%, indicating limited probability of widespread exploitation despite high severity.
Stored cross-site scripting in pulpcore's content serving layer allows authenticated users with file upload permissions to execute arbitrary JavaScript in the browsers of other users. When pulpcore uses local filesystem storage, uploaded files are served with their original MIME types (e.g., text/html, image/svg+xml) and without a Content-Disposition: attachment header, causing browsers to render the files inline within the host application's origin instead of prompting a download. This flaw affects Red Hat Ansible Automation Platform 2, Red Hat Satellite 6, and Red Hat Update Infrastructure 4 and 5; no public exploit code or confirmed active exploitation is identified at time of analysis.
Out-of-bounds memory write in libsolv crashes RPM-based package manager tools (dnf, yum, zypper) when processing a corrupted or specially crafted .solv repository cache file. The root cause is an absent array-index bounds check on directory-id values read from compressed filelist data during .solv file rewriting - but because the out-of-bounds write stores only a fixed, non-attacker-controlled value, the vendor explicitly rules out arbitrary code execution, confining impact to denial of service. No public exploit has been identified and no active exploitation is confirmed; note that the 'RCE' metadata tag conflicts directly with the description and appears to be erroneous.
Arbitrary file write in pulpcore's FilesystemExport feature allows an authenticated administrator to escape the intended export directory via directory-traversal sequences embedded in a user-controlled relative_path. Because the exported file content is also attacker-supplied (an uploaded artifact), the flaw lets a privileged user plant or overwrite arbitrary files anywhere the Pulp service user can write, enabling service compromise or broader host takeover. Rated CVSS 9.0 and reported by Red Hat, it affects pulpcore as embedded in Ansible Automation Platform 2, Satellite 6, and Red Hat Update Infrastructure 4/5; there is no public exploit identified at time of analysis.
Denial of service in libsolv's PGP signature verification (solv_pgpvrfy) allows remote attackers to crash automated package and repository processing by supplying a crafted Ed25519 signature. The flaw is a stack-based buffer overflow (CWE-121) triggered when the EdDSA 's' MPI is copied into a fixed 64-byte stack buffer using an attacker-controlled mismatched length. It affects the libsolv dependency solver embedded in Red Hat Enterprise Linux 7/8/9/10, OpenShift, Satellite, RHUI, openSUSE/SUSE, Ubuntu and Debian; no public exploit identified at time of analysis and it is not in CISA KEV.
Heap buffer overflow in libsolv allows local attackers to corrupt memory when a vulnerable application processes a maliciously crafted .solv repository metadata file. The flaw stems from insufficient input validation during decompression of attacker-controlled data, enabling information disclosure, control-flow alteration, or denial of service across multiple Red Hat Enterprise Linux releases and SUSE distributions. SSVC marks exploitation as PoC-level with total technical impact, while EPSS remains very low at 0.01%, indicating limited probability of widespread exploitation despite high severity.
Stored cross-site scripting in pulpcore's content serving layer allows authenticated users with file upload permissions to execute arbitrary JavaScript in the browsers of other users. When pulpcore uses local filesystem storage, uploaded files are served with their original MIME types (e.g., text/html, image/svg+xml) and without a Content-Disposition: attachment header, causing browsers to render the files inline within the host application's origin instead of prompting a download. This flaw affects Red Hat Ansible Automation Platform 2, Red Hat Satellite 6, and Red Hat Update Infrastructure 4 and 5; no public exploit code or confirmed active exploitation is identified at time of analysis.
Out-of-bounds memory write in libsolv crashes RPM-based package manager tools (dnf, yum, zypper) when processing a corrupted or specially crafted .solv repository cache file. The root cause is an absent array-index bounds check on directory-id values read from compressed filelist data during .solv file rewriting - but because the out-of-bounds write stores only a fixed, non-attacker-controlled value, the vendor explicitly rules out arbitrary code execution, confining impact to denial of service. No public exploit has been identified and no active exploitation is confirmed; note that the 'RCE' metadata tag conflicts directly with the description and appears to be erroneous.