{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "Red Hat Satellite 6: important CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/red-hat--red-hat-satellite-6/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/red-hat--red-hat-satellite-6/important.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-89091/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-89091/",
   "title": "CVE-2026-89091 disclosed",
   "content_text": "A flaw was found in ansible-core. When installing a collection with\n`ansible-galaxy collection install`, the archive extractor validates member\npaths using lexical path normalisation (os.path.abspath) instead of resolving\nsymbolic links (os.path.realpath), and it performs no containment check on\nsymlink-typed directory members before creating them. A crafted collection\ntarball can chain symlink directory entries so that a subsequent file member is\nwritten outside the intended destination directory. This allows an attacker who\ncan get a victim to install a malicious collection to overwrite arbitrary files\nwith the privileges of the user running ansible-galaxy, leading to code\nexecution on the control node. This is a bypass of the fix for CVE-2020-10691.",
   "date_published": "2026-10-08T21:49:30Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-89091/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-89091/",
   "title": "CVE-2026-89091 fixed in openSUSE Tumbleweed",
   "content_text": "Fixed versions: ansible-core 2.21.5-2.1, ansible-core-2.18 2.18.19-3.1, ansible-core-2.19 2.19.14-2.1, ansible-core-2.20 2.20.10-2.1.",
   "date_published": "2026-10-08T21:49:30Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-106471/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-106471/",
   "title": "CVE-2026-106471 disclosed",
   "content_text": "A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Verify-annotated parameters is accessible, instead of requiring access to every verified entity. A low-privilege authenticated attacker who can access the first referenced object can bypass authorization checks on subsequent objects. When target resource identifiers are known, this can enable unauthorized disclosure of consumer information and unauthorized modification of entitlements and related subscription resources, including across organizations.",
   "date_published": "2026-10-07T01:49:11Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12544/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12544/",
   "title": "CVE-2026-12544 disclosed",
   "content_text": "A flaw was found in Foreman. The foreman-rake initialization logic in /usr/share/foreman/config/settings.rb contains a vulnerable code pattern where configuration data is processed through two distinct executable layers. This creates a multi-stage execution chain that allows for both Server-Side Template Injection (SSTI) and insecure deserialization. This vulnerability can lead to remote code execution, total infrastructure compromise and supply chain risk.",
   "date_published": "2026-10-01T16:22:15Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12544/fixed/red-hat-satellite-6.16",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12544/",
   "title": "CVE-2026-12544 fixed in Red Hat satellite 6.16",
   "content_text": "Fixed versions: foreman 0:3.12.0.23-1.el8sat, foreman 0:3.12.0.23-1.el9sat, foreman-cli 0:3.12.0.23-1.el8sat, foreman-cli 0:3.12.0.23-1.el9sat, foreman-debug 0:3.12.0.23-1.el8sat, foreman-debug 0:3.12.0.23-1.el9sat, foreman-dynflow-sidekiq 0:3.12.0.23-1.el8sat, foreman-dynflow-sidekiq 0:3.12.0.23-1.el9sat, foreman-ec2 0:3.12.0.23-1.el8sat, foreman-ec2 0:3.12.0.23-1.el9sat, foreman-journald 0:3.12.0.23-1.el8sat, foreman-journald 0:3.12.0.23-1.el9sat, foreman-libvirt 0:3.12.0.23-1.el8sat, foreman-libvirt 0:3.12.0.23-1.el9sat, foreman-openstack 0:3.12.0.23-1.el8sat, foreman-openstack 0:3.12.0.23-1.el9sat, foreman-ovirt 0:3.12.0.23-1.el8sat, foreman-ovirt 0:3.12.0.23-1.el9sat, foreman-pcp 0:3.12.0.23-1.el8sat, foreman-pcp 0:3.12.0.23-1.el9sat, foreman-postgresql 0:3.12.0.23-1.el8sat, foreman-postgresql 0:3.12.0.23-1.el9sat, foreman-redis 0:3.12.0.23-1.el8sat, foreman-redis 0:3.12.0.23-1.el9sat, foreman-service 0:3.12.0.23-1.el8sat, foreman-service 0:3.12.0.23-1.el9sat, foreman-telemetry 0:3.12.0.23-1.el8sat, foreman-telemetry 0:3.12.0.23-1.el9sat, foreman-vmware 0:3.12.0.23-1.el8sat, foreman-vmware 0:3.12.0.23-1.el9sat, python-dynaconf 0:3.2.13-1.el8pc, python-dynaconf 0:3.2.13-1.el9pc, python-gitpython 0:3.1.62-1.el8pc, python-gitpython 0:3.1.62-1.el9pc, python-lxml 0:4.9.2-5.el8pc, python-lxml 0:4.9.2-5.el9pc, python-lxml-debugsource 0:4.9.2-5.el8pc, python-lxml-debugsource 0:4.9.2-5.el9pc, python-pulpcore 0:3.49.39-4.el8pc, python-pulpcore 0:3.49.39-4.el9pc, python-sqlparse 0:0.6.0-1.el8pc, python-sqlparse 0:0.6.0-1.el9pc, python3.11-dynaconf 0:3.2.13-1.el8pc, python3.11-dynaconf 0:3.2.13-1.el9pc, python3.11-gitpython 0:3.1.62-1.el8pc, python3.11-gitpython 0:3.1.62-1.el9pc, python3.11-lxml 0:4.9.2-5.el8pc, python3.11-lxml 0:4.9.2-5.el9pc, python3.11-lxml-debuginfo 0:4.9.2-5.el8pc, python3.11-lxml-debuginfo 0:4.9.2-5.el9pc, python3.11-pulpcore 0:3.49.39-4.el8pc, python3.11-pulpcore 0:3.49.39-4.el9pc, python3.11-sqlparse 0:0.6.0-1.el8pc, python3.11-sqlparse 0:0.6.0-1.el9pc, rubygem-foreman_remote_execution 0:13.2.8-2.el8sat, rubygem-foreman_remote_execution 0:13.2.8-2.el9sat, rubygem-foreman_remote_execution-cockpit 0:13.2.8-2.el8sat, rubygem-foreman_remote_execution-cockpit 0:13.2.8-2.el9sat, rubygem-hammer_cli 0:3.12.0-2.el8sat, rubygem-hammer_cli 0:3.12.0-2.el9sat, rubygem-katello 0:4.14.0.23-1.el8sat, rubygem-katello 0:4.14.0.23-1.el9sat, rubygem-safemode 0:1.5.0-2.el8sat, rubygem-safemode 0:1.5.0-2.el9sat, satellite 0:6.16.14-1.el8sat, satellite 0:6.16.14-1.el9sat, satellite-cli 0:6.16.14-1.el8sat, satellite-cli 0:6.16.14-1.el9sat, satellite-common 0:6.16.14-1.el8sat, satellite-common 0:6.16.14-1.el9sat, yggdrasil-worker-forwarder 0:0.1.0-2.1.el9sat, yggdrasil-worker-forwarder 0:0.1.0-2.el8sat.",
   "date_published": "2026-10-01T16:22:15Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12544/fixed/red-hat-satellite-6.17",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12544/",
   "title": "CVE-2026-12544 fixed in Red Hat satellite 6.17",
   "content_text": "Fixed versions: foreman 0:3.14.0.22-1.el9sat, foreman-cli 0:3.14.0.22-1.el9sat, foreman-debug 0:3.14.0.22-1.el9sat, foreman-dynflow-sidekiq 0:3.14.0.22-1.el9sat, foreman-ec2 0:3.14.0.22-1.el9sat, foreman-journald 0:3.14.0.22-1.el9sat, foreman-libvirt 0:3.14.0.22-1.el9sat, foreman-openstack 0:3.14.0.22-1.el9sat, foreman-ovirt 0:3.14.0.22-1.el9sat, foreman-pcp 0:3.14.0.22-1.el9sat, foreman-postgresql 0:3.14.0.22-1.el9sat, foreman-redis 0:3.14.0.22-1.el9sat, foreman-service 0:3.14.0.22-1.el9sat, foreman-telemetry 0:3.14.0.22-1.el9sat, foreman-vmware 0:3.14.0.22-1.el9sat, python-dynaconf 0:3.2.13-1.el9pc, python-gitpython 0:3.1.62-1.el9pc, python-lxml 0:5.3.1-2.el9pc, python-lxml-debugsource 0:5.3.1-2.el9pc, python-sqlparse 0:0.6.0-1.el9pc, python3.11-dynaconf 0:3.2.13-1.el9pc, python3.11-gitpython 0:3.1.62-1.el9pc, python3.11-lxml 0:5.3.1-2.el9pc, python3.11-lxml-debuginfo 0:5.3.1-2.el9pc, python3.11-sqlparse 0:0.6.0-1.el9pc, rubygem-foreman_remote_execution 0:15.0.2-2.el9sat, rubygem-foreman_remote_execution-cockpit 0:15.0.2-2.el9sat, rubygem-hammer_cli 0:3.14.0-2.el9sat, rubygem-katello 0:4.16.0.20-1.el9sat, rubygem-safemode 0:1.5.0-2.el9sat, satellite 0:6.17.12-1.el9sat, satellite-cli 0:6.17.12-1.el9sat, satellite-common 0:6.17.12-1.el9sat, satellite-obsolete-packages 0:6.17.12-1.el9sat, yggdrasil-worker-forwarder 0:0.1.0-2.1.el9sat.",
   "date_published": "2026-10-01T16:22:15Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12544/fixed/red-hat-satellite-6.18",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12544/",
   "title": "CVE-2026-12544 fixed in Red Hat satellite 6.18",
   "content_text": "Fixed versions: foreman 0:3.16.0.25-1.el9sat, foreman-cli 0:3.16.0.25-1.el9sat, foreman-debug 0:3.16.0.25-1.el9sat, foreman-dynflow-sidekiq 0:3.16.0.25-1.el9sat, foreman-ec2 0:3.16.0.25-1.el9sat, foreman-journald 0:3.16.0.25-1.el9sat, foreman-libvirt 0:3.16.0.25-1.el9sat, foreman-openstack 0:3.16.0.25-1.el9sat, foreman-pcp 0:3.16.0.25-1.el9sat, foreman-postgresql 0:3.16.0.25-1.el9sat, foreman-redis 0:3.16.0.25-1.el9sat, foreman-service 0:3.16.0.25-1.el9sat, foreman-telemetry 0:3.16.0.25-1.el9sat, foreman-vmware 0:3.16.0.25-1.el9sat, pulpcore-obsolete-packages 0:1.3.1-6.el9pc, python3.12-dynaconf 0:3.2.13-2.el9pc, python3.12-gitpython 0:3.1.62-1.el9pc, python3.12-sqlparse 0:0.6.0-1.el9pc, rubygem-foreman_remote_execution 0:16.2.3-2.el9sat, rubygem-foreman_remote_execution-cockpit 0:16.2.3-2.el9sat, rubygem-hammer_cli 0:3.16.0-2.el9sat, rubygem-katello 0:4.18.0.24-1.el9sat, rubygem-safemode 0:1.5.0-2.el9sat, satellite 0:6.18.10-1.el9sat, satellite-cli 0:6.18.10-1.el9sat, satellite-common 0:6.18.10-1.el9sat, satellite-obsolete-packages 0:6.18.10-1.el9sat, yggdrasil-worker-forwarder 0:0.1.0-2.1.el9sat.",
   "date_published": "2026-10-01T16:22:15Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12544/fixed/red-hat-satellite-6.19",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12544/",
   "title": "CVE-2026-12544 fixed in Red Hat satellite 6.19",
   "content_text": "Fixed versions: foreman 0:3.18.0.14-1.el9sat, foreman-cli 0:3.18.0.14-1.el9sat, foreman-debug 0:3.18.0.14-1.el9sat, foreman-dynflow-sidekiq 0:3.18.0.14-1.el9sat, foreman-ec2 0:3.18.0.14-1.el9sat, foreman-journald 0:3.18.0.14-1.el9sat, foreman-libvirt 0:3.18.0.14-1.el9sat, foreman-openstack 0:3.18.0.14-1.el9sat, foreman-pcp 0:3.18.0.14-1.el9sat, foreman-postgresql 0:3.18.0.14-1.el9sat, foreman-redis 0:3.18.0.14-1.el9sat, foreman-service 0:3.18.0.14-1.el9sat, foreman-telemetry 0:3.18.0.14-1.el9sat, foreman-vmware 0:3.18.0.14-1.el9sat, python3.12-dynaconf 0:3.2.13-2.el9pc, python3.12-gitpython 0:3.1.62-1.el9pc, python3.12-sqlparse 0:0.6.0-1.el9pc, rubygem-foreman_remote_execution 0:16.5.3-2.el9sat, rubygem-foreman_remote_execution-cockpit 0:16.5.3-2.el9sat, rubygem-hammer_cli 0:3.18.0-2.el9sat, rubygem-katello 0:4.20.0.11-1.el9sat, yggdrasil-worker-forwarder 0:0.1.0-2.1.el9sat.",
   "date_published": "2026-10-01T16:22:15Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12544/fixed/red-hat-satellite-capsule-6.16",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12544/",
   "title": "CVE-2026-12544 fixed in Red Hat satellite capsule 6.16",
   "content_text": "Fixed versions: foreman 0:3.12.0.23-1.el8sat, foreman 0:3.12.0.23-1.el9sat, foreman-debug 0:3.12.0.23-1.el8sat, foreman-debug 0:3.12.0.23-1.el9sat, foreman-pcp 0:3.12.0.23-1.el8sat, foreman-pcp 0:3.12.0.23-1.el9sat, python-dynaconf 0:3.2.13-1.el8pc, python-dynaconf 0:3.2.13-1.el9pc, python-gitpython 0:3.1.62-1.el8pc, python-gitpython 0:3.1.62-1.el9pc, python-lxml 0:4.9.2-5.el8pc, python-lxml 0:4.9.2-5.el9pc, python-lxml-debugsource 0:4.9.2-5.el8pc, python-lxml-debugsource 0:4.9.2-5.el9pc, python-pulpcore 0:3.49.39-4.el8pc, python-pulpcore 0:3.49.39-4.el9pc, python-sqlparse 0:0.6.0-1.el8pc, python-sqlparse 0:0.6.0-1.el9pc, python3.11-dynaconf 0:3.2.13-1.el8pc, python3.11-dynaconf 0:3.2.13-1.el9pc, python3.11-gitpython 0:3.1.62-1.el8pc, python3.11-gitpython 0:3.1.62-1.el9pc, python3.11-lxml 0:4.9.2-5.el8pc, python3.11-lxml 0:4.9.2-5.el9pc, python3.11-lxml-debuginfo 0:4.9.2-5.el8pc, python3.11-lxml-debuginfo 0:4.9.2-5.el9pc, python3.11-pulpcore 0:3.49.39-4.el8pc, python3.11-pulpcore 0:3.49.39-4.el9pc, python3.11-sqlparse 0:0.6.0-1.el8pc, python3.11-sqlparse 0:0.6.0-1.el9pc, satellite 0:6.16.14-1.el8sat, satellite 0:6.16.14-1.el9sat, satellite-capsule 0:6.16.14-1.el8sat, satellite-capsule 0:6.16.14-1.el9sat, satellite-common 0:6.16.14-1.el8sat, satellite-common 0:6.16.14-1.el9sat.",
   "date_published": "2026-10-01T16:22:15Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12544/fixed/red-hat-satellite-capsule-6.17",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12544/",
   "title": "CVE-2026-12544 fixed in Red Hat satellite capsule 6.17",
   "content_text": "Fixed versions: foreman 0:3.14.0.22-1.el9sat, foreman-debug 0:3.14.0.22-1.el9sat, foreman-pcp 0:3.14.0.22-1.el9sat, python-dynaconf 0:3.2.13-1.el9pc, python-gitpython 0:3.1.62-1.el9pc, python-lxml 0:5.3.1-2.el9pc, python-lxml-debugsource 0:5.3.1-2.el9pc, python-sqlparse 0:0.6.0-1.el9pc, python3.11-dynaconf 0:3.2.13-1.el9pc, python3.11-gitpython 0:3.1.62-1.el9pc, python3.11-lxml 0:5.3.1-2.el9pc, python3.11-lxml-debuginfo 0:5.3.1-2.el9pc, python3.11-sqlparse 0:0.6.0-1.el9pc, satellite 0:6.17.12-1.el9sat, satellite-capsule 0:6.17.12-1.el9sat, satellite-common 0:6.17.12-1.el9sat, satellite-obsolete-packages 0:6.17.12-1.el9sat.",
   "date_published": "2026-10-01T16:22:15Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12544/fixed/red-hat-satellite-capsule-6.18",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12544/",
   "title": "CVE-2026-12544 fixed in Red Hat satellite capsule 6.18",
   "content_text": "Fixed versions: foreman 0:3.16.0.25-1.el9sat, foreman-debug 0:3.16.0.25-1.el9sat, foreman-pcp 0:3.16.0.25-1.el9sat, pulpcore-obsolete-packages 0:1.3.1-6.el9pc, python3.12-dynaconf 0:3.2.13-2.el9pc, python3.12-gitpython 0:3.1.62-1.el9pc, python3.12-sqlparse 0:0.6.0-1.el9pc, satellite 0:6.18.10-1.el9sat, satellite-capsule 0:6.18.10-1.el9sat, satellite-common 0:6.18.10-1.el9sat, satellite-obsolete-packages 0:6.18.10-1.el9sat.",
   "date_published": "2026-10-01T16:22:15Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12544/fixed/red-hat-satellite-capsule-6.19",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12544/",
   "title": "CVE-2026-12544 fixed in Red Hat satellite capsule 6.19",
   "content_text": "Fixed versions: foreman 0:3.18.0.14-1.el9sat, foreman-debug 0:3.18.0.14-1.el9sat, foreman-pcp 0:3.18.0.14-1.el9sat, python3.12-dynaconf 0:3.2.13-2.el9pc, python3.12-gitpython 0:3.1.62-1.el9pc, python3.12-sqlparse 0:0.6.0-1.el9pc.",
   "date_published": "2026-10-01T16:22:15Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12544/fixed/red-hat-satellite-utils-6.16",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12544/",
   "title": "CVE-2026-12544 fixed in Red Hat satellite utils 6.16",
   "content_text": "Fixed versions: foreman 0:3.12.0.23-1.el8sat, foreman 0:3.12.0.23-1.el9sat, foreman-cli 0:3.12.0.23-1.el8sat, foreman-cli 0:3.12.0.23-1.el9sat, rubygem-hammer_cli 0:3.12.0-2.el8sat, rubygem-hammer_cli 0:3.12.0-2.el9sat, satellite 0:6.16.14-1.el8sat, satellite 0:6.16.14-1.el9sat, satellite-cli 0:6.16.14-1.el8sat, satellite-cli 0:6.16.14-1.el9sat.",
   "date_published": "2026-10-01T16:22:15Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12544/fixed/red-hat-satellite-utils-6.17",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12544/",
   "title": "CVE-2026-12544 fixed in Red Hat satellite utils 6.17",
   "content_text": "Fixed versions: foreman 0:3.14.0.22-1.el9sat, foreman-cli 0:3.14.0.22-1.el9sat, rubygem-hammer_cli 0:3.14.0-2.el9sat, satellite 0:6.17.12-1.el9sat, satellite-cli 0:6.17.12-1.el9sat.",
   "date_published": "2026-10-01T16:22:15Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12544/fixed/red-hat-satellite-utils-6.18",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12544/",
   "title": "CVE-2026-12544 fixed in Red Hat satellite utils 6.18",
   "content_text": "Fixed versions: foreman 0:3.16.0.25-1.el9sat, foreman-cli 0:3.16.0.25-1.el9sat, rubygem-hammer_cli 0:3.16.0-2.el9sat, satellite 0:6.18.10-1.el9sat, satellite-cli 0:6.18.10-1.el9sat.",
   "date_published": "2026-10-01T16:22:15Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12544/fixed/red-hat-satellite-utils-6.19",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12544/",
   "title": "CVE-2026-12544 fixed in Red Hat satellite utils 6.19",
   "content_text": "Fixed versions: foreman 0:3.18.0.14-1.el9sat, foreman-cli 0:3.18.0.14-1.el9sat, rubygem-hammer_cli 0:3.18.0-2.el9sat.",
   "date_published": "2026-10-01T16:22:15Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12541/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12541/",
   "title": "CVE-2026-12541 disclosed",
   "content_text": "A flaw was found in Foreman. OS command injection vulnerabilities exist in the foreman-rake db:dump and db:import_dump tasks. The application fails to properly sanitize user-supplied input in the destination parameter (during backups) and the file parameter (during imports) before passing them to a Ruby system() call for execution. An attacker with permissions to execute foreman-rake (e.g., via a restricted sudo configuration) can append malicious shell commands to the provided file paths.",
   "date_published": "2026-10-01T16:22:09Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12541/fixed/red-hat-satellite-6.16",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12541/",
   "title": "CVE-2026-12541 fixed in Red Hat satellite 6.16",
   "content_text": "Fixed versions: foreman 0:3.12.0.23-1.el8sat, foreman 0:3.12.0.23-1.el9sat, foreman-cli 0:3.12.0.23-1.el8sat, foreman-cli 0:3.12.0.23-1.el9sat, foreman-debug 0:3.12.0.23-1.el8sat, foreman-debug 0:3.12.0.23-1.el9sat, foreman-dynflow-sidekiq 0:3.12.0.23-1.el8sat, foreman-dynflow-sidekiq 0:3.12.0.23-1.el9sat, foreman-ec2 0:3.12.0.23-1.el8sat, foreman-ec2 0:3.12.0.23-1.el9sat, foreman-journald 0:3.12.0.23-1.el8sat, foreman-journald 0:3.12.0.23-1.el9sat, foreman-libvirt 0:3.12.0.23-1.el8sat, foreman-libvirt 0:3.12.0.23-1.el9sat, foreman-openstack 0:3.12.0.23-1.el8sat, foreman-openstack 0:3.12.0.23-1.el9sat, foreman-ovirt 0:3.12.0.23-1.el8sat, foreman-ovirt 0:3.12.0.23-1.el9sat, foreman-pcp 0:3.12.0.23-1.el8sat, foreman-pcp 0:3.12.0.23-1.el9sat, foreman-postgresql 0:3.12.0.23-1.el8sat, foreman-postgresql 0:3.12.0.23-1.el9sat, foreman-redis 0:3.12.0.23-1.el8sat, foreman-redis 0:3.12.0.23-1.el9sat, foreman-service 0:3.12.0.23-1.el8sat, foreman-service 0:3.12.0.23-1.el9sat, foreman-telemetry 0:3.12.0.23-1.el8sat, foreman-telemetry 0:3.12.0.23-1.el9sat, foreman-vmware 0:3.12.0.23-1.el8sat, foreman-vmware 0:3.12.0.23-1.el9sat, python-dynaconf 0:3.2.13-1.el8pc, python-dynaconf 0:3.2.13-1.el9pc, python-gitpython 0:3.1.62-1.el8pc, python-gitpython 0:3.1.62-1.el9pc, python-lxml 0:4.9.2-5.el8pc, python-lxml 0:4.9.2-5.el9pc, python-lxml-debugsource 0:4.9.2-5.el8pc, python-lxml-debugsource 0:4.9.2-5.el9pc, python-pulpcore 0:3.49.39-4.el8pc, python-pulpcore 0:3.49.39-4.el9pc, python-sqlparse 0:0.6.0-1.el8pc, python-sqlparse 0:0.6.0-1.el9pc, python3.11-dynaconf 0:3.2.13-1.el8pc, python3.11-dynaconf 0:3.2.13-1.el9pc, python3.11-gitpython 0:3.1.62-1.el8pc, python3.11-gitpython 0:3.1.62-1.el9pc, python3.11-lxml 0:4.9.2-5.el8pc, python3.11-lxml 0:4.9.2-5.el9pc, python3.11-lxml-debuginfo 0:4.9.2-5.el8pc, python3.11-lxml-debuginfo 0:4.9.2-5.el9pc, python3.11-pulpcore 0:3.49.39-4.el8pc, python3.11-pulpcore 0:3.49.39-4.el9pc, python3.11-sqlparse 0:0.6.0-1.el8pc, python3.11-sqlparse 0:0.6.0-1.el9pc, rubygem-foreman_remote_execution 0:13.2.8-2.el8sat, rubygem-foreman_remote_execution 0:13.2.8-2.el9sat, rubygem-foreman_remote_execution-cockpit 0:13.2.8-2.el8sat, rubygem-foreman_remote_execution-cockpit 0:13.2.8-2.el9sat, rubygem-hammer_cli 0:3.12.0-2.el8sat, rubygem-hammer_cli 0:3.12.0-2.el9sat, rubygem-katello 0:4.14.0.23-1.el8sat, rubygem-katello 0:4.14.0.23-1.el9sat, rubygem-safemode 0:1.5.0-2.el8sat, rubygem-safemode 0:1.5.0-2.el9sat, satellite 0:6.16.14-1.el8sat, satellite 0:6.16.14-1.el9sat, satellite-cli 0:6.16.14-1.el8sat, satellite-cli 0:6.16.14-1.el9sat, satellite-common 0:6.16.14-1.el8sat, satellite-common 0:6.16.14-1.el9sat, yggdrasil-worker-forwarder 0:0.1.0-2.1.el9sat, yggdrasil-worker-forwarder 0:0.1.0-2.el8sat.",
   "date_published": "2026-10-01T16:22:09Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12541/fixed/red-hat-satellite-6.17",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12541/",
   "title": "CVE-2026-12541 fixed in Red Hat satellite 6.17",
   "content_text": "Fixed versions: foreman 0:3.14.0.22-1.el9sat, foreman-cli 0:3.14.0.22-1.el9sat, foreman-debug 0:3.14.0.22-1.el9sat, foreman-dynflow-sidekiq 0:3.14.0.22-1.el9sat, foreman-ec2 0:3.14.0.22-1.el9sat, foreman-journald 0:3.14.0.22-1.el9sat, foreman-libvirt 0:3.14.0.22-1.el9sat, foreman-openstack 0:3.14.0.22-1.el9sat, foreman-ovirt 0:3.14.0.22-1.el9sat, foreman-pcp 0:3.14.0.22-1.el9sat, foreman-postgresql 0:3.14.0.22-1.el9sat, foreman-redis 0:3.14.0.22-1.el9sat, foreman-service 0:3.14.0.22-1.el9sat, foreman-telemetry 0:3.14.0.22-1.el9sat, foreman-vmware 0:3.14.0.22-1.el9sat, python-dynaconf 0:3.2.13-1.el9pc, python-gitpython 0:3.1.62-1.el9pc, python-lxml 0:5.3.1-2.el9pc, python-lxml-debugsource 0:5.3.1-2.el9pc, python-sqlparse 0:0.6.0-1.el9pc, python3.11-dynaconf 0:3.2.13-1.el9pc, python3.11-gitpython 0:3.1.62-1.el9pc, python3.11-lxml 0:5.3.1-2.el9pc, python3.11-lxml-debuginfo 0:5.3.1-2.el9pc, python3.11-sqlparse 0:0.6.0-1.el9pc, rubygem-foreman_remote_execution 0:15.0.2-2.el9sat, rubygem-foreman_remote_execution-cockpit 0:15.0.2-2.el9sat, rubygem-hammer_cli 0:3.14.0-2.el9sat, rubygem-katello 0:4.16.0.20-1.el9sat, rubygem-safemode 0:1.5.0-2.el9sat, satellite 0:6.17.12-1.el9sat, satellite-cli 0:6.17.12-1.el9sat, satellite-common 0:6.17.12-1.el9sat, satellite-obsolete-packages 0:6.17.12-1.el9sat, yggdrasil-worker-forwarder 0:0.1.0-2.1.el9sat.",
   "date_published": "2026-10-01T16:22:09Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12541/fixed/red-hat-satellite-6.18",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12541/",
   "title": "CVE-2026-12541 fixed in Red Hat satellite 6.18",
   "content_text": "Fixed versions: foreman 0:3.16.0.25-1.el9sat, foreman-cli 0:3.16.0.25-1.el9sat, foreman-debug 0:3.16.0.25-1.el9sat, foreman-dynflow-sidekiq 0:3.16.0.25-1.el9sat, foreman-ec2 0:3.16.0.25-1.el9sat, foreman-journald 0:3.16.0.25-1.el9sat, foreman-libvirt 0:3.16.0.25-1.el9sat, foreman-openstack 0:3.16.0.25-1.el9sat, foreman-pcp 0:3.16.0.25-1.el9sat, foreman-postgresql 0:3.16.0.25-1.el9sat, foreman-redis 0:3.16.0.25-1.el9sat, foreman-service 0:3.16.0.25-1.el9sat, foreman-telemetry 0:3.16.0.25-1.el9sat, foreman-vmware 0:3.16.0.25-1.el9sat, pulpcore-obsolete-packages 0:1.3.1-6.el9pc, python3.12-dynaconf 0:3.2.13-2.el9pc, python3.12-gitpython 0:3.1.62-1.el9pc, python3.12-sqlparse 0:0.6.0-1.el9pc, rubygem-foreman_remote_execution 0:16.2.3-2.el9sat, rubygem-foreman_remote_execution-cockpit 0:16.2.3-2.el9sat, rubygem-hammer_cli 0:3.16.0-2.el9sat, rubygem-katello 0:4.18.0.24-1.el9sat, rubygem-safemode 0:1.5.0-2.el9sat, satellite 0:6.18.10-1.el9sat, satellite-cli 0:6.18.10-1.el9sat, satellite-common 0:6.18.10-1.el9sat, satellite-obsolete-packages 0:6.18.10-1.el9sat, yggdrasil-worker-forwarder 0:0.1.0-2.1.el9sat.",
   "date_published": "2026-10-01T16:22:09Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12541/fixed/red-hat-satellite-6.19",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12541/",
   "title": "CVE-2026-12541 fixed in Red Hat satellite 6.19",
   "content_text": "Fixed versions: foreman 0:3.18.0.14-1.el9sat, foreman-cli 0:3.18.0.14-1.el9sat, foreman-debug 0:3.18.0.14-1.el9sat, foreman-dynflow-sidekiq 0:3.18.0.14-1.el9sat, foreman-ec2 0:3.18.0.14-1.el9sat, foreman-journald 0:3.18.0.14-1.el9sat, foreman-libvirt 0:3.18.0.14-1.el9sat, foreman-openstack 0:3.18.0.14-1.el9sat, foreman-pcp 0:3.18.0.14-1.el9sat, foreman-postgresql 0:3.18.0.14-1.el9sat, foreman-redis 0:3.18.0.14-1.el9sat, foreman-service 0:3.18.0.14-1.el9sat, foreman-telemetry 0:3.18.0.14-1.el9sat, foreman-vmware 0:3.18.0.14-1.el9sat, python3.12-dynaconf 0:3.2.13-2.el9pc, python3.12-gitpython 0:3.1.62-1.el9pc, python3.12-sqlparse 0:0.6.0-1.el9pc, rubygem-foreman_remote_execution 0:16.5.3-2.el9sat, rubygem-foreman_remote_execution-cockpit 0:16.5.3-2.el9sat, rubygem-hammer_cli 0:3.18.0-2.el9sat, rubygem-katello 0:4.20.0.11-1.el9sat, yggdrasil-worker-forwarder 0:0.1.0-2.1.el9sat.",
   "date_published": "2026-10-01T16:22:09Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12541/fixed/red-hat-satellite-capsule-6.16",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12541/",
   "title": "CVE-2026-12541 fixed in Red Hat satellite capsule 6.16",
   "content_text": "Fixed versions: foreman 0:3.12.0.23-1.el8sat, foreman 0:3.12.0.23-1.el9sat, foreman-debug 0:3.12.0.23-1.el8sat, foreman-debug 0:3.12.0.23-1.el9sat, foreman-pcp 0:3.12.0.23-1.el8sat, foreman-pcp 0:3.12.0.23-1.el9sat, python-dynaconf 0:3.2.13-1.el8pc, python-dynaconf 0:3.2.13-1.el9pc, python-gitpython 0:3.1.62-1.el8pc, python-gitpython 0:3.1.62-1.el9pc, python-lxml 0:4.9.2-5.el8pc, python-lxml 0:4.9.2-5.el9pc, python-lxml-debugsource 0:4.9.2-5.el8pc, python-lxml-debugsource 0:4.9.2-5.el9pc, python-pulpcore 0:3.49.39-4.el8pc, python-pulpcore 0:3.49.39-4.el9pc, python-sqlparse 0:0.6.0-1.el8pc, python-sqlparse 0:0.6.0-1.el9pc, python3.11-dynaconf 0:3.2.13-1.el8pc, python3.11-dynaconf 0:3.2.13-1.el9pc, python3.11-gitpython 0:3.1.62-1.el8pc, python3.11-gitpython 0:3.1.62-1.el9pc, python3.11-lxml 0:4.9.2-5.el8pc, python3.11-lxml 0:4.9.2-5.el9pc, python3.11-lxml-debuginfo 0:4.9.2-5.el8pc, python3.11-lxml-debuginfo 0:4.9.2-5.el9pc, python3.11-pulpcore 0:3.49.39-4.el8pc, python3.11-pulpcore 0:3.49.39-4.el9pc, python3.11-sqlparse 0:0.6.0-1.el8pc, python3.11-sqlparse 0:0.6.0-1.el9pc, satellite 0:6.16.14-1.el8sat, satellite 0:6.16.14-1.el9sat, satellite-capsule 0:6.16.14-1.el8sat, satellite-capsule 0:6.16.14-1.el9sat, satellite-common 0:6.16.14-1.el8sat, satellite-common 0:6.16.14-1.el9sat.",
   "date_published": "2026-10-01T16:22:09Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12541/fixed/red-hat-satellite-capsule-6.17",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12541/",
   "title": "CVE-2026-12541 fixed in Red Hat satellite capsule 6.17",
   "content_text": "Fixed versions: foreman 0:3.14.0.22-1.el9sat, foreman-debug 0:3.14.0.22-1.el9sat, foreman-pcp 0:3.14.0.22-1.el9sat, python-dynaconf 0:3.2.13-1.el9pc, python-gitpython 0:3.1.62-1.el9pc, python-lxml 0:5.3.1-2.el9pc, python-lxml-debugsource 0:5.3.1-2.el9pc, python-sqlparse 0:0.6.0-1.el9pc, python3.11-dynaconf 0:3.2.13-1.el9pc, python3.11-gitpython 0:3.1.62-1.el9pc, python3.11-lxml 0:5.3.1-2.el9pc, python3.11-lxml-debuginfo 0:5.3.1-2.el9pc, python3.11-sqlparse 0:0.6.0-1.el9pc, satellite 0:6.17.12-1.el9sat, satellite-capsule 0:6.17.12-1.el9sat, satellite-common 0:6.17.12-1.el9sat, satellite-obsolete-packages 0:6.17.12-1.el9sat.",
   "date_published": "2026-10-01T16:22:09Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12541/fixed/red-hat-satellite-capsule-6.18",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12541/",
   "title": "CVE-2026-12541 fixed in Red Hat satellite capsule 6.18",
   "content_text": "Fixed versions: foreman 0:3.16.0.25-1.el9sat, foreman-debug 0:3.16.0.25-1.el9sat, foreman-pcp 0:3.16.0.25-1.el9sat, pulpcore-obsolete-packages 0:1.3.1-6.el9pc, python3.12-dynaconf 0:3.2.13-2.el9pc, python3.12-gitpython 0:3.1.62-1.el9pc, python3.12-sqlparse 0:0.6.0-1.el9pc, satellite 0:6.18.10-1.el9sat, satellite-capsule 0:6.18.10-1.el9sat, satellite-common 0:6.18.10-1.el9sat, satellite-obsolete-packages 0:6.18.10-1.el9sat.",
   "date_published": "2026-10-01T16:22:09Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12541/fixed/red-hat-satellite-capsule-6.19",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12541/",
   "title": "CVE-2026-12541 fixed in Red Hat satellite capsule 6.19",
   "content_text": "Fixed versions: foreman 0:3.18.0.14-1.el9sat, foreman-debug 0:3.18.0.14-1.el9sat, foreman-pcp 0:3.18.0.14-1.el9sat, python3.12-dynaconf 0:3.2.13-2.el9pc, python3.12-gitpython 0:3.1.62-1.el9pc, python3.12-sqlparse 0:0.6.0-1.el9pc.",
   "date_published": "2026-10-01T16:22:09Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12541/fixed/red-hat-satellite-utils-6.16",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12541/",
   "title": "CVE-2026-12541 fixed in Red Hat satellite utils 6.16",
   "content_text": "Fixed versions: foreman 0:3.12.0.23-1.el8sat, foreman 0:3.12.0.23-1.el9sat, foreman-cli 0:3.12.0.23-1.el8sat, foreman-cli 0:3.12.0.23-1.el9sat, rubygem-hammer_cli 0:3.12.0-2.el8sat, rubygem-hammer_cli 0:3.12.0-2.el9sat, satellite 0:6.16.14-1.el8sat, satellite 0:6.16.14-1.el9sat, satellite-cli 0:6.16.14-1.el8sat, satellite-cli 0:6.16.14-1.el9sat.",
   "date_published": "2026-10-01T16:22:09Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12541/fixed/red-hat-satellite-utils-6.17",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12541/",
   "title": "CVE-2026-12541 fixed in Red Hat satellite utils 6.17",
   "content_text": "Fixed versions: foreman 0:3.14.0.22-1.el9sat, foreman-cli 0:3.14.0.22-1.el9sat, rubygem-hammer_cli 0:3.14.0-2.el9sat, satellite 0:6.17.12-1.el9sat, satellite-cli 0:6.17.12-1.el9sat.",
   "date_published": "2026-10-01T16:22:09Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12541/fixed/red-hat-satellite-utils-6.18",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12541/",
   "title": "CVE-2026-12541 fixed in Red Hat satellite utils 6.18",
   "content_text": "Fixed versions: foreman 0:3.16.0.25-1.el9sat, foreman-cli 0:3.16.0.25-1.el9sat, rubygem-hammer_cli 0:3.16.0-2.el9sat, satellite 0:6.18.10-1.el9sat, satellite-cli 0:6.18.10-1.el9sat.",
   "date_published": "2026-10-01T16:22:09Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12541/fixed/red-hat-satellite-utils-6.19",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12541/",
   "title": "CVE-2026-12541 fixed in Red Hat satellite utils 6.19",
   "content_text": "Fixed versions: foreman 0:3.18.0.14-1.el9sat, foreman-cli 0:3.18.0.14-1.el9sat, rubygem-hammer_cli 0:3.18.0-2.el9sat.",
   "date_published": "2026-10-01T16:22:09Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12540/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12540/",
   "title": "CVE-2026-12540 disclosed",
   "content_text": "A flaw was found in Foreman. A command injection vulnerability exists in the foreman-rake errors:fetch_log task. The request_id parameter is passed to an underlying system command (typically grep) without adequate shell neutralization. While the task is intended to fetch specific log entries, an attacker with sudo permissions to execute this rake task can inject shell metacharacters (such as ;, \", or |) to break out of the intended command and execute arbitrary code.",
   "date_published": "2026-10-01T16:22:02Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12540/fixed/red-hat-satellite-6.16",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12540/",
   "title": "CVE-2026-12540 fixed in Red Hat satellite 6.16",
   "content_text": "Fixed versions: foreman 0:3.12.0.23-1.el8sat, foreman 0:3.12.0.23-1.el9sat, foreman-cli 0:3.12.0.23-1.el8sat, foreman-cli 0:3.12.0.23-1.el9sat, foreman-debug 0:3.12.0.23-1.el8sat, foreman-debug 0:3.12.0.23-1.el9sat, foreman-dynflow-sidekiq 0:3.12.0.23-1.el8sat, foreman-dynflow-sidekiq 0:3.12.0.23-1.el9sat, foreman-ec2 0:3.12.0.23-1.el8sat, foreman-ec2 0:3.12.0.23-1.el9sat, foreman-journald 0:3.12.0.23-1.el8sat, foreman-journald 0:3.12.0.23-1.el9sat, foreman-libvirt 0:3.12.0.23-1.el8sat, foreman-libvirt 0:3.12.0.23-1.el9sat, foreman-openstack 0:3.12.0.23-1.el8sat, foreman-openstack 0:3.12.0.23-1.el9sat, foreman-ovirt 0:3.12.0.23-1.el8sat, foreman-ovirt 0:3.12.0.23-1.el9sat, foreman-pcp 0:3.12.0.23-1.el8sat, foreman-pcp 0:3.12.0.23-1.el9sat, foreman-postgresql 0:3.12.0.23-1.el8sat, foreman-postgresql 0:3.12.0.23-1.el9sat, foreman-redis 0:3.12.0.23-1.el8sat, foreman-redis 0:3.12.0.23-1.el9sat, foreman-service 0:3.12.0.23-1.el8sat, foreman-service 0:3.12.0.23-1.el9sat, foreman-telemetry 0:3.12.0.23-1.el8sat, foreman-telemetry 0:3.12.0.23-1.el9sat, foreman-vmware 0:3.12.0.23-1.el8sat, foreman-vmware 0:3.12.0.23-1.el9sat, python-dynaconf 0:3.2.13-1.el8pc, python-dynaconf 0:3.2.13-1.el9pc, python-gitpython 0:3.1.62-1.el8pc, python-gitpython 0:3.1.62-1.el9pc, python-lxml 0:4.9.2-5.el8pc, python-lxml 0:4.9.2-5.el9pc, python-lxml-debugsource 0:4.9.2-5.el8pc, python-lxml-debugsource 0:4.9.2-5.el9pc, python-pulpcore 0:3.49.39-4.el8pc, python-pulpcore 0:3.49.39-4.el9pc, python-sqlparse 0:0.6.0-1.el8pc, python-sqlparse 0:0.6.0-1.el9pc, python3.11-dynaconf 0:3.2.13-1.el8pc, python3.11-dynaconf 0:3.2.13-1.el9pc, python3.11-gitpython 0:3.1.62-1.el8pc, python3.11-gitpython 0:3.1.62-1.el9pc, python3.11-lxml 0:4.9.2-5.el8pc, python3.11-lxml 0:4.9.2-5.el9pc, python3.11-lxml-debuginfo 0:4.9.2-5.el8pc, python3.11-lxml-debuginfo 0:4.9.2-5.el9pc, python3.11-pulpcore 0:3.49.39-4.el8pc, python3.11-pulpcore 0:3.49.39-4.el9pc, python3.11-sqlparse 0:0.6.0-1.el8pc, python3.11-sqlparse 0:0.6.0-1.el9pc, rubygem-foreman_remote_execution 0:13.2.8-2.el8sat, rubygem-foreman_remote_execution 0:13.2.8-2.el9sat, rubygem-foreman_remote_execution-cockpit 0:13.2.8-2.el8sat, rubygem-foreman_remote_execution-cockpit 0:13.2.8-2.el9sat, rubygem-hammer_cli 0:3.12.0-2.el8sat, rubygem-hammer_cli 0:3.12.0-2.el9sat, rubygem-katello 0:4.14.0.23-1.el8sat, rubygem-katello 0:4.14.0.23-1.el9sat, rubygem-safemode 0:1.5.0-2.el8sat, rubygem-safemode 0:1.5.0-2.el9sat, satellite 0:6.16.14-1.el8sat, satellite 0:6.16.14-1.el9sat, satellite-cli 0:6.16.14-1.el8sat, satellite-cli 0:6.16.14-1.el9sat, satellite-common 0:6.16.14-1.el8sat, satellite-common 0:6.16.14-1.el9sat, yggdrasil-worker-forwarder 0:0.1.0-2.1.el9sat, yggdrasil-worker-forwarder 0:0.1.0-2.el8sat.",
   "date_published": "2026-10-01T16:22:02Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12540/fixed/red-hat-satellite-6.17",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12540/",
   "title": "CVE-2026-12540 fixed in Red Hat satellite 6.17",
   "content_text": "Fixed versions: foreman 0:3.14.0.22-1.el9sat, foreman-cli 0:3.14.0.22-1.el9sat, foreman-debug 0:3.14.0.22-1.el9sat, foreman-dynflow-sidekiq 0:3.14.0.22-1.el9sat, foreman-ec2 0:3.14.0.22-1.el9sat, foreman-journald 0:3.14.0.22-1.el9sat, foreman-libvirt 0:3.14.0.22-1.el9sat, foreman-openstack 0:3.14.0.22-1.el9sat, foreman-ovirt 0:3.14.0.22-1.el9sat, foreman-pcp 0:3.14.0.22-1.el9sat, foreman-postgresql 0:3.14.0.22-1.el9sat, foreman-redis 0:3.14.0.22-1.el9sat, foreman-service 0:3.14.0.22-1.el9sat, foreman-telemetry 0:3.14.0.22-1.el9sat, foreman-vmware 0:3.14.0.22-1.el9sat, python-dynaconf 0:3.2.13-1.el9pc, python-gitpython 0:3.1.62-1.el9pc, python-lxml 0:5.3.1-2.el9pc, python-lxml-debugsource 0:5.3.1-2.el9pc, python-sqlparse 0:0.6.0-1.el9pc, python3.11-dynaconf 0:3.2.13-1.el9pc, python3.11-gitpython 0:3.1.62-1.el9pc, python3.11-lxml 0:5.3.1-2.el9pc, python3.11-lxml-debuginfo 0:5.3.1-2.el9pc, python3.11-sqlparse 0:0.6.0-1.el9pc, rubygem-foreman_remote_execution 0:15.0.2-2.el9sat, rubygem-foreman_remote_execution-cockpit 0:15.0.2-2.el9sat, rubygem-hammer_cli 0:3.14.0-2.el9sat, rubygem-katello 0:4.16.0.20-1.el9sat, rubygem-safemode 0:1.5.0-2.el9sat, satellite 0:6.17.12-1.el9sat, satellite-cli 0:6.17.12-1.el9sat, satellite-common 0:6.17.12-1.el9sat, satellite-obsolete-packages 0:6.17.12-1.el9sat, yggdrasil-worker-forwarder 0:0.1.0-2.1.el9sat.",
   "date_published": "2026-10-01T16:22:02Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12540/fixed/red-hat-satellite-6.18",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12540/",
   "title": "CVE-2026-12540 fixed in Red Hat satellite 6.18",
   "content_text": "Fixed versions: foreman 0:3.16.0.25-1.el9sat, foreman-cli 0:3.16.0.25-1.el9sat, foreman-debug 0:3.16.0.25-1.el9sat, foreman-dynflow-sidekiq 0:3.16.0.25-1.el9sat, foreman-ec2 0:3.16.0.25-1.el9sat, foreman-journald 0:3.16.0.25-1.el9sat, foreman-libvirt 0:3.16.0.25-1.el9sat, foreman-openstack 0:3.16.0.25-1.el9sat, foreman-pcp 0:3.16.0.25-1.el9sat, foreman-postgresql 0:3.16.0.25-1.el9sat, foreman-redis 0:3.16.0.25-1.el9sat, foreman-service 0:3.16.0.25-1.el9sat, foreman-telemetry 0:3.16.0.25-1.el9sat, foreman-vmware 0:3.16.0.25-1.el9sat, pulpcore-obsolete-packages 0:1.3.1-6.el9pc, python3.12-dynaconf 0:3.2.13-2.el9pc, python3.12-gitpython 0:3.1.62-1.el9pc, python3.12-sqlparse 0:0.6.0-1.el9pc, rubygem-foreman_remote_execution 0:16.2.3-2.el9sat, rubygem-foreman_remote_execution-cockpit 0:16.2.3-2.el9sat, rubygem-hammer_cli 0:3.16.0-2.el9sat, rubygem-katello 0:4.18.0.24-1.el9sat, rubygem-safemode 0:1.5.0-2.el9sat, satellite 0:6.18.10-1.el9sat, satellite-cli 0:6.18.10-1.el9sat, satellite-common 0:6.18.10-1.el9sat, satellite-obsolete-packages 0:6.18.10-1.el9sat, yggdrasil-worker-forwarder 0:0.1.0-2.1.el9sat.",
   "date_published": "2026-10-01T16:22:02Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12540/fixed/red-hat-satellite-6.19",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12540/",
   "title": "CVE-2026-12540 fixed in Red Hat satellite 6.19",
   "content_text": "Fixed versions: foreman 0:3.18.0.14-1.el9sat, foreman-cli 0:3.18.0.14-1.el9sat, foreman-debug 0:3.18.0.14-1.el9sat, foreman-dynflow-sidekiq 0:3.18.0.14-1.el9sat, foreman-ec2 0:3.18.0.14-1.el9sat, foreman-journald 0:3.18.0.14-1.el9sat, foreman-libvirt 0:3.18.0.14-1.el9sat, foreman-openstack 0:3.18.0.14-1.el9sat, foreman-pcp 0:3.18.0.14-1.el9sat, foreman-postgresql 0:3.18.0.14-1.el9sat, foreman-redis 0:3.18.0.14-1.el9sat, foreman-service 0:3.18.0.14-1.el9sat, foreman-telemetry 0:3.18.0.14-1.el9sat, foreman-vmware 0:3.18.0.14-1.el9sat, python3.12-dynaconf 0:3.2.13-2.el9pc, python3.12-gitpython 0:3.1.62-1.el9pc, python3.12-sqlparse 0:0.6.0-1.el9pc, rubygem-foreman_remote_execution 0:16.5.3-2.el9sat, rubygem-foreman_remote_execution-cockpit 0:16.5.3-2.el9sat, rubygem-hammer_cli 0:3.18.0-2.el9sat, rubygem-katello 0:4.20.0.11-1.el9sat, yggdrasil-worker-forwarder 0:0.1.0-2.1.el9sat.",
   "date_published": "2026-10-01T16:22:02Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12540/fixed/red-hat-satellite-capsule-6.16",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12540/",
   "title": "CVE-2026-12540 fixed in Red Hat satellite capsule 6.16",
   "content_text": "Fixed versions: foreman 0:3.12.0.23-1.el8sat, foreman 0:3.12.0.23-1.el9sat, foreman-debug 0:3.12.0.23-1.el8sat, foreman-debug 0:3.12.0.23-1.el9sat, foreman-pcp 0:3.12.0.23-1.el8sat, foreman-pcp 0:3.12.0.23-1.el9sat, python-dynaconf 0:3.2.13-1.el8pc, python-dynaconf 0:3.2.13-1.el9pc, python-gitpython 0:3.1.62-1.el8pc, python-gitpython 0:3.1.62-1.el9pc, python-lxml 0:4.9.2-5.el8pc, python-lxml 0:4.9.2-5.el9pc, python-lxml-debugsource 0:4.9.2-5.el8pc, python-lxml-debugsource 0:4.9.2-5.el9pc, python-pulpcore 0:3.49.39-4.el8pc, python-pulpcore 0:3.49.39-4.el9pc, python-sqlparse 0:0.6.0-1.el8pc, python-sqlparse 0:0.6.0-1.el9pc, python3.11-dynaconf 0:3.2.13-1.el8pc, python3.11-dynaconf 0:3.2.13-1.el9pc, python3.11-gitpython 0:3.1.62-1.el8pc, python3.11-gitpython 0:3.1.62-1.el9pc, python3.11-lxml 0:4.9.2-5.el8pc, python3.11-lxml 0:4.9.2-5.el9pc, python3.11-lxml-debuginfo 0:4.9.2-5.el8pc, python3.11-lxml-debuginfo 0:4.9.2-5.el9pc, python3.11-pulpcore 0:3.49.39-4.el8pc, python3.11-pulpcore 0:3.49.39-4.el9pc, python3.11-sqlparse 0:0.6.0-1.el8pc, python3.11-sqlparse 0:0.6.0-1.el9pc, satellite 0:6.16.14-1.el8sat, satellite 0:6.16.14-1.el9sat, satellite-capsule 0:6.16.14-1.el8sat, satellite-capsule 0:6.16.14-1.el9sat, satellite-common 0:6.16.14-1.el8sat, satellite-common 0:6.16.14-1.el9sat.",
   "date_published": "2026-10-01T16:22:02Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12540/fixed/red-hat-satellite-capsule-6.17",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12540/",
   "title": "CVE-2026-12540 fixed in Red Hat satellite capsule 6.17",
   "content_text": "Fixed versions: foreman 0:3.14.0.22-1.el9sat, foreman-debug 0:3.14.0.22-1.el9sat, foreman-pcp 0:3.14.0.22-1.el9sat, python-dynaconf 0:3.2.13-1.el9pc, python-gitpython 0:3.1.62-1.el9pc, python-lxml 0:5.3.1-2.el9pc, python-lxml-debugsource 0:5.3.1-2.el9pc, python-sqlparse 0:0.6.0-1.el9pc, python3.11-dynaconf 0:3.2.13-1.el9pc, python3.11-gitpython 0:3.1.62-1.el9pc, python3.11-lxml 0:5.3.1-2.el9pc, python3.11-lxml-debuginfo 0:5.3.1-2.el9pc, python3.11-sqlparse 0:0.6.0-1.el9pc, satellite 0:6.17.12-1.el9sat, satellite-capsule 0:6.17.12-1.el9sat, satellite-common 0:6.17.12-1.el9sat, satellite-obsolete-packages 0:6.17.12-1.el9sat.",
   "date_published": "2026-10-01T16:22:02Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12540/fixed/red-hat-satellite-capsule-6.18",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12540/",
   "title": "CVE-2026-12540 fixed in Red Hat satellite capsule 6.18",
   "content_text": "Fixed versions: foreman 0:3.16.0.25-1.el9sat, foreman-debug 0:3.16.0.25-1.el9sat, foreman-pcp 0:3.16.0.25-1.el9sat, pulpcore-obsolete-packages 0:1.3.1-6.el9pc, python3.12-dynaconf 0:3.2.13-2.el9pc, python3.12-gitpython 0:3.1.62-1.el9pc, python3.12-sqlparse 0:0.6.0-1.el9pc, satellite 0:6.18.10-1.el9sat, satellite-capsule 0:6.18.10-1.el9sat, satellite-common 0:6.18.10-1.el9sat, satellite-obsolete-packages 0:6.18.10-1.el9sat.",
   "date_published": "2026-10-01T16:22:02Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12540/fixed/red-hat-satellite-capsule-6.19",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12540/",
   "title": "CVE-2026-12540 fixed in Red Hat satellite capsule 6.19",
   "content_text": "Fixed versions: foreman 0:3.18.0.14-1.el9sat, foreman-debug 0:3.18.0.14-1.el9sat, foreman-pcp 0:3.18.0.14-1.el9sat, python3.12-dynaconf 0:3.2.13-2.el9pc, python3.12-gitpython 0:3.1.62-1.el9pc, python3.12-sqlparse 0:0.6.0-1.el9pc.",
   "date_published": "2026-10-01T16:22:02Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12540/fixed/red-hat-satellite-utils-6.16",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12540/",
   "title": "CVE-2026-12540 fixed in Red Hat satellite utils 6.16",
   "content_text": "Fixed versions: foreman 0:3.12.0.23-1.el8sat, foreman 0:3.12.0.23-1.el9sat, foreman-cli 0:3.12.0.23-1.el8sat, foreman-cli 0:3.12.0.23-1.el9sat, rubygem-hammer_cli 0:3.12.0-2.el8sat, rubygem-hammer_cli 0:3.12.0-2.el9sat, satellite 0:6.16.14-1.el8sat, satellite 0:6.16.14-1.el9sat, satellite-cli 0:6.16.14-1.el8sat, satellite-cli 0:6.16.14-1.el9sat.",
   "date_published": "2026-10-01T16:22:02Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12540/fixed/red-hat-satellite-utils-6.17",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12540/",
   "title": "CVE-2026-12540 fixed in Red Hat satellite utils 6.17",
   "content_text": "Fixed versions: foreman 0:3.14.0.22-1.el9sat, foreman-cli 0:3.14.0.22-1.el9sat, rubygem-hammer_cli 0:3.14.0-2.el9sat, satellite 0:6.17.12-1.el9sat, satellite-cli 0:6.17.12-1.el9sat.",
   "date_published": "2026-10-01T16:22:02Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12540/fixed/red-hat-satellite-utils-6.18",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12540/",
   "title": "CVE-2026-12540 fixed in Red Hat satellite utils 6.18",
   "content_text": "Fixed versions: foreman 0:3.16.0.25-1.el9sat, foreman-cli 0:3.16.0.25-1.el9sat, rubygem-hammer_cli 0:3.16.0-2.el9sat, satellite 0:6.18.10-1.el9sat, satellite-cli 0:6.18.10-1.el9sat.",
   "date_published": "2026-10-01T16:22:02Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12540/fixed/red-hat-satellite-utils-6.19",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12540/",
   "title": "CVE-2026-12540 fixed in Red Hat satellite utils 6.19",
   "content_text": "Fixed versions: foreman 0:3.18.0.14-1.el9sat, foreman-cli 0:3.18.0.14-1.el9sat, rubygem-hammer_cli 0:3.18.0-2.el9sat.",
   "date_published": "2026-10-01T16:22:02Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12423/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12423/",
   "title": "CVE-2026-12423 disclosed",
   "content_text": "A flaw was found in Foreman. The Red Hat Satellite /unattended/provision API endpoint is vulnerable to an authentication bypass due to a semantic logic flaw in host_verifier.rb. The application verifies the database state of a provisioning token rather than its actual presence in the incoming HTTP request. Because a host actively undergoing provisioning has an unexpired token in the database, the server's valid_host_token? method evaluates to true, granting access to the kickstart template even if the requester provides no token at all in the URL.",
   "date_published": "2026-10-01T16:21:52Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12423/fixed/red-hat-satellite-6.16",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12423/",
   "title": "CVE-2026-12423 fixed in Red Hat satellite 6.16",
   "content_text": "Fixed versions: foreman 0:3.12.0.23-1.el8sat, foreman 0:3.12.0.23-1.el9sat, foreman-cli 0:3.12.0.23-1.el8sat, foreman-cli 0:3.12.0.23-1.el9sat, foreman-debug 0:3.12.0.23-1.el8sat, foreman-debug 0:3.12.0.23-1.el9sat, foreman-dynflow-sidekiq 0:3.12.0.23-1.el8sat, foreman-dynflow-sidekiq 0:3.12.0.23-1.el9sat, foreman-ec2 0:3.12.0.23-1.el8sat, foreman-ec2 0:3.12.0.23-1.el9sat, foreman-journald 0:3.12.0.23-1.el8sat, foreman-journald 0:3.12.0.23-1.el9sat, foreman-libvirt 0:3.12.0.23-1.el8sat, foreman-libvirt 0:3.12.0.23-1.el9sat, foreman-openstack 0:3.12.0.23-1.el8sat, foreman-openstack 0:3.12.0.23-1.el9sat, foreman-ovirt 0:3.12.0.23-1.el8sat, foreman-ovirt 0:3.12.0.23-1.el9sat, foreman-pcp 0:3.12.0.23-1.el8sat, foreman-pcp 0:3.12.0.23-1.el9sat, foreman-postgresql 0:3.12.0.23-1.el8sat, foreman-postgresql 0:3.12.0.23-1.el9sat, foreman-redis 0:3.12.0.23-1.el8sat, foreman-redis 0:3.12.0.23-1.el9sat, foreman-service 0:3.12.0.23-1.el8sat, foreman-service 0:3.12.0.23-1.el9sat, foreman-telemetry 0:3.12.0.23-1.el8sat, foreman-telemetry 0:3.12.0.23-1.el9sat, foreman-vmware 0:3.12.0.23-1.el8sat, foreman-vmware 0:3.12.0.23-1.el9sat, python-dynaconf 0:3.2.13-1.el8pc, python-dynaconf 0:3.2.13-1.el9pc, python-gitpython 0:3.1.62-1.el8pc, python-gitpython 0:3.1.62-1.el9pc, python-lxml 0:4.9.2-5.el8pc, python-lxml 0:4.9.2-5.el9pc, python-lxml-debugsource 0:4.9.2-5.el8pc, python-lxml-debugsource 0:4.9.2-5.el9pc, python-pulpcore 0:3.49.39-4.el8pc, python-pulpcore 0:3.49.39-4.el9pc, python-sqlparse 0:0.6.0-1.el8pc, python-sqlparse 0:0.6.0-1.el9pc, python3.11-dynaconf 0:3.2.13-1.el8pc, python3.11-dynaconf 0:3.2.13-1.el9pc, python3.11-gitpython 0:3.1.62-1.el8pc, python3.11-gitpython 0:3.1.62-1.el9pc, python3.11-lxml 0:4.9.2-5.el8pc, python3.11-lxml 0:4.9.2-5.el9pc, python3.11-lxml-debuginfo 0:4.9.2-5.el8pc, python3.11-lxml-debuginfo 0:4.9.2-5.el9pc, python3.11-pulpcore 0:3.49.39-4.el8pc, python3.11-pulpcore 0:3.49.39-4.el9pc, python3.11-sqlparse 0:0.6.0-1.el8pc, python3.11-sqlparse 0:0.6.0-1.el9pc, rubygem-foreman_remote_execution 0:13.2.8-2.el8sat, rubygem-foreman_remote_execution 0:13.2.8-2.el9sat, rubygem-foreman_remote_execution-cockpit 0:13.2.8-2.el8sat, rubygem-foreman_remote_execution-cockpit 0:13.2.8-2.el9sat, rubygem-hammer_cli 0:3.12.0-2.el8sat, rubygem-hammer_cli 0:3.12.0-2.el9sat, rubygem-katello 0:4.14.0.23-1.el8sat, rubygem-katello 0:4.14.0.23-1.el9sat, rubygem-safemode 0:1.5.0-2.el8sat, rubygem-safemode 0:1.5.0-2.el9sat, satellite 0:6.16.14-1.el8sat, satellite 0:6.16.14-1.el9sat, satellite-cli 0:6.16.14-1.el8sat, satellite-cli 0:6.16.14-1.el9sat, satellite-common 0:6.16.14-1.el8sat, satellite-common 0:6.16.14-1.el9sat, yggdrasil-worker-forwarder 0:0.1.0-2.1.el9sat, yggdrasil-worker-forwarder 0:0.1.0-2.el8sat.",
   "date_published": "2026-10-01T16:21:52Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12423/fixed/red-hat-satellite-6.17",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12423/",
   "title": "CVE-2026-12423 fixed in Red Hat satellite 6.17",
   "content_text": "Fixed versions: foreman 0:3.14.0.22-1.el9sat, foreman-cli 0:3.14.0.22-1.el9sat, foreman-debug 0:3.14.0.22-1.el9sat, foreman-dynflow-sidekiq 0:3.14.0.22-1.el9sat, foreman-ec2 0:3.14.0.22-1.el9sat, foreman-journald 0:3.14.0.22-1.el9sat, foreman-libvirt 0:3.14.0.22-1.el9sat, foreman-openstack 0:3.14.0.22-1.el9sat, foreman-ovirt 0:3.14.0.22-1.el9sat, foreman-pcp 0:3.14.0.22-1.el9sat, foreman-postgresql 0:3.14.0.22-1.el9sat, foreman-redis 0:3.14.0.22-1.el9sat, foreman-service 0:3.14.0.22-1.el9sat, foreman-telemetry 0:3.14.0.22-1.el9sat, foreman-vmware 0:3.14.0.22-1.el9sat, python-dynaconf 0:3.2.13-1.el9pc, python-gitpython 0:3.1.62-1.el9pc, python-lxml 0:5.3.1-2.el9pc, python-lxml-debugsource 0:5.3.1-2.el9pc, python-sqlparse 0:0.6.0-1.el9pc, python3.11-dynaconf 0:3.2.13-1.el9pc, python3.11-gitpython 0:3.1.62-1.el9pc, python3.11-lxml 0:5.3.1-2.el9pc, python3.11-lxml-debuginfo 0:5.3.1-2.el9pc, python3.11-sqlparse 0:0.6.0-1.el9pc, rubygem-foreman_remote_execution 0:15.0.2-2.el9sat, rubygem-foreman_remote_execution-cockpit 0:15.0.2-2.el9sat, rubygem-hammer_cli 0:3.14.0-2.el9sat, rubygem-katello 0:4.16.0.20-1.el9sat, rubygem-safemode 0:1.5.0-2.el9sat, satellite 0:6.17.12-1.el9sat, satellite-cli 0:6.17.12-1.el9sat, satellite-common 0:6.17.12-1.el9sat, satellite-obsolete-packages 0:6.17.12-1.el9sat, yggdrasil-worker-forwarder 0:0.1.0-2.1.el9sat.",
   "date_published": "2026-10-01T16:21:52Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12423/fixed/red-hat-satellite-6.18",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12423/",
   "title": "CVE-2026-12423 fixed in Red Hat satellite 6.18",
   "content_text": "Fixed versions: foreman 0:3.16.0.25-1.el9sat, foreman-cli 0:3.16.0.25-1.el9sat, foreman-debug 0:3.16.0.25-1.el9sat, foreman-dynflow-sidekiq 0:3.16.0.25-1.el9sat, foreman-ec2 0:3.16.0.25-1.el9sat, foreman-journald 0:3.16.0.25-1.el9sat, foreman-libvirt 0:3.16.0.25-1.el9sat, foreman-openstack 0:3.16.0.25-1.el9sat, foreman-pcp 0:3.16.0.25-1.el9sat, foreman-postgresql 0:3.16.0.25-1.el9sat, foreman-redis 0:3.16.0.25-1.el9sat, foreman-service 0:3.16.0.25-1.el9sat, foreman-telemetry 0:3.16.0.25-1.el9sat, foreman-vmware 0:3.16.0.25-1.el9sat, pulpcore-obsolete-packages 0:1.3.1-6.el9pc, python3.12-dynaconf 0:3.2.13-2.el9pc, python3.12-gitpython 0:3.1.62-1.el9pc, python3.12-sqlparse 0:0.6.0-1.el9pc, rubygem-foreman_remote_execution 0:16.2.3-2.el9sat, rubygem-foreman_remote_execution-cockpit 0:16.2.3-2.el9sat, rubygem-hammer_cli 0:3.16.0-2.el9sat, rubygem-katello 0:4.18.0.24-1.el9sat, rubygem-safemode 0:1.5.0-2.el9sat, satellite 0:6.18.10-1.el9sat, satellite-cli 0:6.18.10-1.el9sat, satellite-common 0:6.18.10-1.el9sat, satellite-obsolete-packages 0:6.18.10-1.el9sat, yggdrasil-worker-forwarder 0:0.1.0-2.1.el9sat.",
   "date_published": "2026-10-01T16:21:52Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12423/fixed/red-hat-satellite-6.19",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12423/",
   "title": "CVE-2026-12423 fixed in Red Hat satellite 6.19",
   "content_text": "Fixed versions: foreman 0:3.18.0.14-1.el9sat, foreman-cli 0:3.18.0.14-1.el9sat, foreman-debug 0:3.18.0.14-1.el9sat, foreman-dynflow-sidekiq 0:3.18.0.14-1.el9sat, foreman-ec2 0:3.18.0.14-1.el9sat, foreman-journald 0:3.18.0.14-1.el9sat, foreman-libvirt 0:3.18.0.14-1.el9sat, foreman-openstack 0:3.18.0.14-1.el9sat, foreman-pcp 0:3.18.0.14-1.el9sat, foreman-postgresql 0:3.18.0.14-1.el9sat, foreman-redis 0:3.18.0.14-1.el9sat, foreman-service 0:3.18.0.14-1.el9sat, foreman-telemetry 0:3.18.0.14-1.el9sat, foreman-vmware 0:3.18.0.14-1.el9sat, python3.12-dynaconf 0:3.2.13-2.el9pc, python3.12-gitpython 0:3.1.62-1.el9pc, python3.12-sqlparse 0:0.6.0-1.el9pc, rubygem-foreman_remote_execution 0:16.5.3-2.el9sat, rubygem-foreman_remote_execution-cockpit 0:16.5.3-2.el9sat, rubygem-hammer_cli 0:3.18.0-2.el9sat, rubygem-katello 0:4.20.0.11-1.el9sat, yggdrasil-worker-forwarder 0:0.1.0-2.1.el9sat.",
   "date_published": "2026-10-01T16:21:52Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12423/fixed/red-hat-satellite-capsule-6.16",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12423/",
   "title": "CVE-2026-12423 fixed in Red Hat satellite capsule 6.16",
   "content_text": "Fixed versions: foreman 0:3.12.0.23-1.el8sat, foreman 0:3.12.0.23-1.el9sat, foreman-debug 0:3.12.0.23-1.el8sat, foreman-debug 0:3.12.0.23-1.el9sat, foreman-pcp 0:3.12.0.23-1.el8sat, foreman-pcp 0:3.12.0.23-1.el9sat, python-dynaconf 0:3.2.13-1.el8pc, python-dynaconf 0:3.2.13-1.el9pc, python-gitpython 0:3.1.62-1.el8pc, python-gitpython 0:3.1.62-1.el9pc, python-lxml 0:4.9.2-5.el8pc, python-lxml 0:4.9.2-5.el9pc, python-lxml-debugsource 0:4.9.2-5.el8pc, python-lxml-debugsource 0:4.9.2-5.el9pc, python-pulpcore 0:3.49.39-4.el8pc, python-pulpcore 0:3.49.39-4.el9pc, python-sqlparse 0:0.6.0-1.el8pc, python-sqlparse 0:0.6.0-1.el9pc, python3.11-dynaconf 0:3.2.13-1.el8pc, python3.11-dynaconf 0:3.2.13-1.el9pc, python3.11-gitpython 0:3.1.62-1.el8pc, python3.11-gitpython 0:3.1.62-1.el9pc, python3.11-lxml 0:4.9.2-5.el8pc, python3.11-lxml 0:4.9.2-5.el9pc, python3.11-lxml-debuginfo 0:4.9.2-5.el8pc, python3.11-lxml-debuginfo 0:4.9.2-5.el9pc, python3.11-pulpcore 0:3.49.39-4.el8pc, python3.11-pulpcore 0:3.49.39-4.el9pc, python3.11-sqlparse 0:0.6.0-1.el8pc, python3.11-sqlparse 0:0.6.0-1.el9pc, satellite 0:6.16.14-1.el8sat, satellite 0:6.16.14-1.el9sat, satellite-capsule 0:6.16.14-1.el8sat, satellite-capsule 0:6.16.14-1.el9sat, satellite-common 0:6.16.14-1.el8sat, satellite-common 0:6.16.14-1.el9sat.",
   "date_published": "2026-10-01T16:21:52Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12423/fixed/red-hat-satellite-capsule-6.17",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12423/",
   "title": "CVE-2026-12423 fixed in Red Hat satellite capsule 6.17",
   "content_text": "Fixed versions: foreman 0:3.14.0.22-1.el9sat, foreman-debug 0:3.14.0.22-1.el9sat, foreman-pcp 0:3.14.0.22-1.el9sat, python-dynaconf 0:3.2.13-1.el9pc, python-gitpython 0:3.1.62-1.el9pc, python-lxml 0:5.3.1-2.el9pc, python-lxml-debugsource 0:5.3.1-2.el9pc, python-sqlparse 0:0.6.0-1.el9pc, python3.11-dynaconf 0:3.2.13-1.el9pc, python3.11-gitpython 0:3.1.62-1.el9pc, python3.11-lxml 0:5.3.1-2.el9pc, python3.11-lxml-debuginfo 0:5.3.1-2.el9pc, python3.11-sqlparse 0:0.6.0-1.el9pc, satellite 0:6.17.12-1.el9sat, satellite-capsule 0:6.17.12-1.el9sat, satellite-common 0:6.17.12-1.el9sat, satellite-obsolete-packages 0:6.17.12-1.el9sat.",
   "date_published": "2026-10-01T16:21:52Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12423/fixed/red-hat-satellite-capsule-6.18",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12423/",
   "title": "CVE-2026-12423 fixed in Red Hat satellite capsule 6.18",
   "content_text": "Fixed versions: foreman 0:3.16.0.25-1.el9sat, foreman-debug 0:3.16.0.25-1.el9sat, foreman-pcp 0:3.16.0.25-1.el9sat, pulpcore-obsolete-packages 0:1.3.1-6.el9pc, python3.12-dynaconf 0:3.2.13-2.el9pc, python3.12-gitpython 0:3.1.62-1.el9pc, python3.12-sqlparse 0:0.6.0-1.el9pc, satellite 0:6.18.10-1.el9sat, satellite-capsule 0:6.18.10-1.el9sat, satellite-common 0:6.18.10-1.el9sat, satellite-obsolete-packages 0:6.18.10-1.el9sat.",
   "date_published": "2026-10-01T16:21:52Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12423/fixed/red-hat-satellite-capsule-6.19",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12423/",
   "title": "CVE-2026-12423 fixed in Red Hat satellite capsule 6.19",
   "content_text": "Fixed versions: foreman 0:3.18.0.14-1.el9sat, foreman-debug 0:3.18.0.14-1.el9sat, foreman-pcp 0:3.18.0.14-1.el9sat, python3.12-dynaconf 0:3.2.13-2.el9pc, python3.12-gitpython 0:3.1.62-1.el9pc, python3.12-sqlparse 0:0.6.0-1.el9pc.",
   "date_published": "2026-10-01T16:21:52Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12423/fixed/red-hat-satellite-utils-6.16",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12423/",
   "title": "CVE-2026-12423 fixed in Red Hat satellite utils 6.16",
   "content_text": "Fixed versions: foreman 0:3.12.0.23-1.el8sat, foreman 0:3.12.0.23-1.el9sat, foreman-cli 0:3.12.0.23-1.el8sat, foreman-cli 0:3.12.0.23-1.el9sat, rubygem-hammer_cli 0:3.12.0-2.el8sat, rubygem-hammer_cli 0:3.12.0-2.el9sat, satellite 0:6.16.14-1.el8sat, satellite 0:6.16.14-1.el9sat, satellite-cli 0:6.16.14-1.el8sat, satellite-cli 0:6.16.14-1.el9sat.",
   "date_published": "2026-10-01T16:21:52Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12423/fixed/red-hat-satellite-utils-6.17",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12423/",
   "title": "CVE-2026-12423 fixed in Red Hat satellite utils 6.17",
   "content_text": "Fixed versions: foreman 0:3.14.0.22-1.el9sat, foreman-cli 0:3.14.0.22-1.el9sat, rubygem-hammer_cli 0:3.14.0-2.el9sat, satellite 0:6.17.12-1.el9sat, satellite-cli 0:6.17.12-1.el9sat.",
   "date_published": "2026-10-01T16:21:52Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12423/fixed/red-hat-satellite-utils-6.18",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12423/",
   "title": "CVE-2026-12423 fixed in Red Hat satellite utils 6.18",
   "content_text": "Fixed versions: foreman 0:3.16.0.25-1.el9sat, foreman-cli 0:3.16.0.25-1.el9sat, rubygem-hammer_cli 0:3.16.0-2.el9sat, satellite 0:6.18.10-1.el9sat, satellite-cli 0:6.18.10-1.el9sat.",
   "date_published": "2026-10-01T16:21:52Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12423/fixed/red-hat-satellite-utils-6.19",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12423/",
   "title": "CVE-2026-12423 fixed in Red Hat satellite utils 6.19",
   "content_text": "Fixed versions: foreman 0:3.18.0.14-1.el9sat, foreman-cli 0:3.18.0.14-1.el9sat, rubygem-hammer_cli 0:3.18.0-2.el9sat.",
   "date_published": "2026-10-01T16:21:52Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12405/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12405/",
   "title": "CVE-2026-12405 disclosed",
   "content_text": "A flaw was found in rubygem-foreman_remote_execution. A command injection vulnerability exists in the Red Hat Satellite API (/api/v2/job_invocations). When a job template has the effective_user property marked as overridable: true, the application fails to properly sanitize the effective_user input provided during the API request. The exploitation does not rely on the content or logic of the Job Template/playbook itself; rather, the injection occurs during the instantiation of the job execution environment by the Satellite server. An attacker with permissions to execute job templates can inject arbitrary shell commands into this parameter, which are executed on the target infrastructure with the privileges of the execution user.",
   "date_published": "2026-10-01T16:21:44Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12405/fixed/red-hat-satellite-6.16",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12405/",
   "title": "CVE-2026-12405 fixed in Red Hat satellite 6.16",
   "content_text": "Fixed versions: foreman 0:3.12.0.23-1.el8sat, foreman 0:3.12.0.23-1.el9sat, foreman-cli 0:3.12.0.23-1.el8sat, foreman-cli 0:3.12.0.23-1.el9sat, foreman-debug 0:3.12.0.23-1.el8sat, foreman-debug 0:3.12.0.23-1.el9sat, foreman-dynflow-sidekiq 0:3.12.0.23-1.el8sat, foreman-dynflow-sidekiq 0:3.12.0.23-1.el9sat, foreman-ec2 0:3.12.0.23-1.el8sat, foreman-ec2 0:3.12.0.23-1.el9sat, foreman-journald 0:3.12.0.23-1.el8sat, foreman-journald 0:3.12.0.23-1.el9sat, foreman-libvirt 0:3.12.0.23-1.el8sat, foreman-libvirt 0:3.12.0.23-1.el9sat, foreman-openstack 0:3.12.0.23-1.el8sat, foreman-openstack 0:3.12.0.23-1.el9sat, foreman-ovirt 0:3.12.0.23-1.el8sat, foreman-ovirt 0:3.12.0.23-1.el9sat, foreman-pcp 0:3.12.0.23-1.el8sat, foreman-pcp 0:3.12.0.23-1.el9sat, foreman-postgresql 0:3.12.0.23-1.el8sat, foreman-postgresql 0:3.12.0.23-1.el9sat, foreman-redis 0:3.12.0.23-1.el8sat, foreman-redis 0:3.12.0.23-1.el9sat, foreman-service 0:3.12.0.23-1.el8sat, foreman-service 0:3.12.0.23-1.el9sat, foreman-telemetry 0:3.12.0.23-1.el8sat, foreman-telemetry 0:3.12.0.23-1.el9sat, foreman-vmware 0:3.12.0.23-1.el8sat, foreman-vmware 0:3.12.0.23-1.el9sat, python-dynaconf 0:3.2.13-1.el8pc, python-dynaconf 0:3.2.13-1.el9pc, python-gitpython 0:3.1.62-1.el8pc, python-gitpython 0:3.1.62-1.el9pc, python-lxml 0:4.9.2-5.el8pc, python-lxml 0:4.9.2-5.el9pc, python-lxml-debugsource 0:4.9.2-5.el8pc, python-lxml-debugsource 0:4.9.2-5.el9pc, python-pulpcore 0:3.49.39-4.el8pc, python-pulpcore 0:3.49.39-4.el9pc, python-sqlparse 0:0.6.0-1.el8pc, python-sqlparse 0:0.6.0-1.el9pc, python3.11-dynaconf 0:3.2.13-1.el8pc, python3.11-dynaconf 0:3.2.13-1.el9pc, python3.11-gitpython 0:3.1.62-1.el8pc, python3.11-gitpython 0:3.1.62-1.el9pc, python3.11-lxml 0:4.9.2-5.el8pc, python3.11-lxml 0:4.9.2-5.el9pc, python3.11-lxml-debuginfo 0:4.9.2-5.el8pc, python3.11-lxml-debuginfo 0:4.9.2-5.el9pc, python3.11-pulpcore 0:3.49.39-4.el8pc, python3.11-pulpcore 0:3.49.39-4.el9pc, python3.11-sqlparse 0:0.6.0-1.el8pc, python3.11-sqlparse 0:0.6.0-1.el9pc, rubygem-foreman_remote_execution 0:13.2.8-2.el8sat, rubygem-foreman_remote_execution 0:13.2.8-2.el9sat, rubygem-foreman_remote_execution-cockpit 0:13.2.8-2.el8sat, rubygem-foreman_remote_execution-cockpit 0:13.2.8-2.el9sat, rubygem-hammer_cli 0:3.12.0-2.el8sat, rubygem-hammer_cli 0:3.12.0-2.el9sat, rubygem-katello 0:4.14.0.23-1.el8sat, rubygem-katello 0:4.14.0.23-1.el9sat, rubygem-safemode 0:1.5.0-2.el8sat, rubygem-safemode 0:1.5.0-2.el9sat, satellite 0:6.16.14-1.el8sat, satellite 0:6.16.14-1.el9sat, satellite-cli 0:6.16.14-1.el8sat, satellite-cli 0:6.16.14-1.el9sat, satellite-common 0:6.16.14-1.el8sat, satellite-common 0:6.16.14-1.el9sat, yggdrasil-worker-forwarder 0:0.1.0-2.1.el9sat, yggdrasil-worker-forwarder 0:0.1.0-2.el8sat.",
   "date_published": "2026-10-01T16:21:44Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12405/fixed/red-hat-satellite-6.17",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12405/",
   "title": "CVE-2026-12405 fixed in Red Hat satellite 6.17",
   "content_text": "Fixed versions: foreman 0:3.14.0.22-1.el9sat, foreman-cli 0:3.14.0.22-1.el9sat, foreman-debug 0:3.14.0.22-1.el9sat, foreman-dynflow-sidekiq 0:3.14.0.22-1.el9sat, foreman-ec2 0:3.14.0.22-1.el9sat, foreman-journald 0:3.14.0.22-1.el9sat, foreman-libvirt 0:3.14.0.22-1.el9sat, foreman-openstack 0:3.14.0.22-1.el9sat, foreman-ovirt 0:3.14.0.22-1.el9sat, foreman-pcp 0:3.14.0.22-1.el9sat, foreman-postgresql 0:3.14.0.22-1.el9sat, foreman-redis 0:3.14.0.22-1.el9sat, foreman-service 0:3.14.0.22-1.el9sat, foreman-telemetry 0:3.14.0.22-1.el9sat, foreman-vmware 0:3.14.0.22-1.el9sat, python-dynaconf 0:3.2.13-1.el9pc, python-gitpython 0:3.1.62-1.el9pc, python-lxml 0:5.3.1-2.el9pc, python-lxml-debugsource 0:5.3.1-2.el9pc, python-sqlparse 0:0.6.0-1.el9pc, python3.11-dynaconf 0:3.2.13-1.el9pc, python3.11-gitpython 0:3.1.62-1.el9pc, python3.11-lxml 0:5.3.1-2.el9pc, python3.11-lxml-debuginfo 0:5.3.1-2.el9pc, python3.11-sqlparse 0:0.6.0-1.el9pc, rubygem-foreman_remote_execution 0:15.0.2-2.el9sat, rubygem-foreman_remote_execution-cockpit 0:15.0.2-2.el9sat, rubygem-hammer_cli 0:3.14.0-2.el9sat, rubygem-katello 0:4.16.0.20-1.el9sat, rubygem-safemode 0:1.5.0-2.el9sat, satellite 0:6.17.12-1.el9sat, satellite-cli 0:6.17.12-1.el9sat, satellite-common 0:6.17.12-1.el9sat, satellite-obsolete-packages 0:6.17.12-1.el9sat, yggdrasil-worker-forwarder 0:0.1.0-2.1.el9sat.",
   "date_published": "2026-10-01T16:21:44Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12405/fixed/red-hat-satellite-6.18",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12405/",
   "title": "CVE-2026-12405 fixed in Red Hat satellite 6.18",
   "content_text": "Fixed versions: foreman 0:3.16.0.25-1.el9sat, foreman-cli 0:3.16.0.25-1.el9sat, foreman-debug 0:3.16.0.25-1.el9sat, foreman-dynflow-sidekiq 0:3.16.0.25-1.el9sat, foreman-ec2 0:3.16.0.25-1.el9sat, foreman-journald 0:3.16.0.25-1.el9sat, foreman-libvirt 0:3.16.0.25-1.el9sat, foreman-openstack 0:3.16.0.25-1.el9sat, foreman-pcp 0:3.16.0.25-1.el9sat, foreman-postgresql 0:3.16.0.25-1.el9sat, foreman-redis 0:3.16.0.25-1.el9sat, foreman-service 0:3.16.0.25-1.el9sat, foreman-telemetry 0:3.16.0.25-1.el9sat, foreman-vmware 0:3.16.0.25-1.el9sat, pulpcore-obsolete-packages 0:1.3.1-6.el9pc, python3.12-dynaconf 0:3.2.13-2.el9pc, python3.12-gitpython 0:3.1.62-1.el9pc, python3.12-sqlparse 0:0.6.0-1.el9pc, rubygem-foreman_remote_execution 0:16.2.3-2.el9sat, rubygem-foreman_remote_execution-cockpit 0:16.2.3-2.el9sat, rubygem-hammer_cli 0:3.16.0-2.el9sat, rubygem-katello 0:4.18.0.24-1.el9sat, rubygem-safemode 0:1.5.0-2.el9sat, satellite 0:6.18.10-1.el9sat, satellite-cli 0:6.18.10-1.el9sat, satellite-common 0:6.18.10-1.el9sat, satellite-obsolete-packages 0:6.18.10-1.el9sat, yggdrasil-worker-forwarder 0:0.1.0-2.1.el9sat.",
   "date_published": "2026-10-01T16:21:44Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12405/fixed/red-hat-satellite-6.19",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12405/",
   "title": "CVE-2026-12405 fixed in Red Hat satellite 6.19",
   "content_text": "Fixed versions: foreman 0:3.18.0.14-1.el9sat, foreman-cli 0:3.18.0.14-1.el9sat, foreman-debug 0:3.18.0.14-1.el9sat, foreman-dynflow-sidekiq 0:3.18.0.14-1.el9sat, foreman-ec2 0:3.18.0.14-1.el9sat, foreman-journald 0:3.18.0.14-1.el9sat, foreman-libvirt 0:3.18.0.14-1.el9sat, foreman-openstack 0:3.18.0.14-1.el9sat, foreman-pcp 0:3.18.0.14-1.el9sat, foreman-postgresql 0:3.18.0.14-1.el9sat, foreman-redis 0:3.18.0.14-1.el9sat, foreman-service 0:3.18.0.14-1.el9sat, foreman-telemetry 0:3.18.0.14-1.el9sat, foreman-vmware 0:3.18.0.14-1.el9sat, python3.12-dynaconf 0:3.2.13-2.el9pc, python3.12-gitpython 0:3.1.62-1.el9pc, python3.12-sqlparse 0:0.6.0-1.el9pc, rubygem-foreman_remote_execution 0:16.5.3-2.el9sat, rubygem-foreman_remote_execution-cockpit 0:16.5.3-2.el9sat, rubygem-hammer_cli 0:3.18.0-2.el9sat, rubygem-katello 0:4.20.0.11-1.el9sat, yggdrasil-worker-forwarder 0:0.1.0-2.1.el9sat.",
   "date_published": "2026-10-01T16:21:44Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12405/fixed/red-hat-satellite-capsule-6.16",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12405/",
   "title": "CVE-2026-12405 fixed in Red Hat satellite capsule 6.16",
   "content_text": "Fixed versions: foreman 0:3.12.0.23-1.el8sat, foreman 0:3.12.0.23-1.el9sat, foreman-debug 0:3.12.0.23-1.el8sat, foreman-debug 0:3.12.0.23-1.el9sat, foreman-pcp 0:3.12.0.23-1.el8sat, foreman-pcp 0:3.12.0.23-1.el9sat, python-dynaconf 0:3.2.13-1.el8pc, python-dynaconf 0:3.2.13-1.el9pc, python-gitpython 0:3.1.62-1.el8pc, python-gitpython 0:3.1.62-1.el9pc, python-lxml 0:4.9.2-5.el8pc, python-lxml 0:4.9.2-5.el9pc, python-lxml-debugsource 0:4.9.2-5.el8pc, python-lxml-debugsource 0:4.9.2-5.el9pc, python-pulpcore 0:3.49.39-4.el8pc, python-pulpcore 0:3.49.39-4.el9pc, python-sqlparse 0:0.6.0-1.el8pc, python-sqlparse 0:0.6.0-1.el9pc, python3.11-dynaconf 0:3.2.13-1.el8pc, python3.11-dynaconf 0:3.2.13-1.el9pc, python3.11-gitpython 0:3.1.62-1.el8pc, python3.11-gitpython 0:3.1.62-1.el9pc, python3.11-lxml 0:4.9.2-5.el8pc, python3.11-lxml 0:4.9.2-5.el9pc, python3.11-lxml-debuginfo 0:4.9.2-5.el8pc, python3.11-lxml-debuginfo 0:4.9.2-5.el9pc, python3.11-pulpcore 0:3.49.39-4.el8pc, python3.11-pulpcore 0:3.49.39-4.el9pc, python3.11-sqlparse 0:0.6.0-1.el8pc, python3.11-sqlparse 0:0.6.0-1.el9pc, satellite 0:6.16.14-1.el8sat, satellite 0:6.16.14-1.el9sat, satellite-capsule 0:6.16.14-1.el8sat, satellite-capsule 0:6.16.14-1.el9sat, satellite-common 0:6.16.14-1.el8sat, satellite-common 0:6.16.14-1.el9sat.",
   "date_published": "2026-10-01T16:21:44Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12405/fixed/red-hat-satellite-capsule-6.17",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12405/",
   "title": "CVE-2026-12405 fixed in Red Hat satellite capsule 6.17",
   "content_text": "Fixed versions: foreman 0:3.14.0.22-1.el9sat, foreman-debug 0:3.14.0.22-1.el9sat, foreman-pcp 0:3.14.0.22-1.el9sat, python-dynaconf 0:3.2.13-1.el9pc, python-gitpython 0:3.1.62-1.el9pc, python-lxml 0:5.3.1-2.el9pc, python-lxml-debugsource 0:5.3.1-2.el9pc, python-sqlparse 0:0.6.0-1.el9pc, python3.11-dynaconf 0:3.2.13-1.el9pc, python3.11-gitpython 0:3.1.62-1.el9pc, python3.11-lxml 0:5.3.1-2.el9pc, python3.11-lxml-debuginfo 0:5.3.1-2.el9pc, python3.11-sqlparse 0:0.6.0-1.el9pc, satellite 0:6.17.12-1.el9sat, satellite-capsule 0:6.17.12-1.el9sat, satellite-common 0:6.17.12-1.el9sat, satellite-obsolete-packages 0:6.17.12-1.el9sat.",
   "date_published": "2026-10-01T16:21:44Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12405/fixed/red-hat-satellite-capsule-6.18",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12405/",
   "title": "CVE-2026-12405 fixed in Red Hat satellite capsule 6.18",
   "content_text": "Fixed versions: foreman 0:3.16.0.25-1.el9sat, foreman-debug 0:3.16.0.25-1.el9sat, foreman-pcp 0:3.16.0.25-1.el9sat, pulpcore-obsolete-packages 0:1.3.1-6.el9pc, python3.12-dynaconf 0:3.2.13-2.el9pc, python3.12-gitpython 0:3.1.62-1.el9pc, python3.12-sqlparse 0:0.6.0-1.el9pc, satellite 0:6.18.10-1.el9sat, satellite-capsule 0:6.18.10-1.el9sat, satellite-common 0:6.18.10-1.el9sat, satellite-obsolete-packages 0:6.18.10-1.el9sat.",
   "date_published": "2026-10-01T16:21:44Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12405/fixed/red-hat-satellite-capsule-6.19",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12405/",
   "title": "CVE-2026-12405 fixed in Red Hat satellite capsule 6.19",
   "content_text": "Fixed versions: foreman 0:3.18.0.14-1.el9sat, foreman-debug 0:3.18.0.14-1.el9sat, foreman-pcp 0:3.18.0.14-1.el9sat, python3.12-dynaconf 0:3.2.13-2.el9pc, python3.12-gitpython 0:3.1.62-1.el9pc, python3.12-sqlparse 0:0.6.0-1.el9pc.",
   "date_published": "2026-10-01T16:21:44Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12405/fixed/red-hat-satellite-utils-6.16",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12405/",
   "title": "CVE-2026-12405 fixed in Red Hat satellite utils 6.16",
   "content_text": "Fixed versions: foreman 0:3.12.0.23-1.el8sat, foreman 0:3.12.0.23-1.el9sat, foreman-cli 0:3.12.0.23-1.el8sat, foreman-cli 0:3.12.0.23-1.el9sat, rubygem-hammer_cli 0:3.12.0-2.el8sat, rubygem-hammer_cli 0:3.12.0-2.el9sat, satellite 0:6.16.14-1.el8sat, satellite 0:6.16.14-1.el9sat, satellite-cli 0:6.16.14-1.el8sat, satellite-cli 0:6.16.14-1.el9sat.",
   "date_published": "2026-10-01T16:21:44Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12405/fixed/red-hat-satellite-utils-6.17",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12405/",
   "title": "CVE-2026-12405 fixed in Red Hat satellite utils 6.17",
   "content_text": "Fixed versions: foreman 0:3.14.0.22-1.el9sat, foreman-cli 0:3.14.0.22-1.el9sat, rubygem-hammer_cli 0:3.14.0-2.el9sat, satellite 0:6.17.12-1.el9sat, satellite-cli 0:6.17.12-1.el9sat.",
   "date_published": "2026-10-01T16:21:44Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12405/fixed/red-hat-satellite-utils-6.18",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12405/",
   "title": "CVE-2026-12405 fixed in Red Hat satellite utils 6.18",
   "content_text": "Fixed versions: foreman 0:3.16.0.25-1.el9sat, foreman-cli 0:3.16.0.25-1.el9sat, rubygem-hammer_cli 0:3.16.0-2.el9sat, satellite 0:6.18.10-1.el9sat, satellite-cli 0:6.18.10-1.el9sat.",
   "date_published": "2026-10-01T16:21:44Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-12405/fixed/red-hat-satellite-utils-6.19",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-12405/",
   "title": "CVE-2026-12405 fixed in Red Hat satellite utils 6.19",
   "content_text": "Fixed versions: foreman 0:3.18.0.14-1.el9sat, foreman-cli 0:3.18.0.14-1.el9sat, rubygem-hammer_cli 0:3.18.0-2.el9sat.",
   "date_published": "2026-10-01T16:21:44Z"
  }
 ]
}