Alerts This Week
Warning Icon 1 727
Alerts This Week
Warning Icon 1 727

Red Hat Satellite 6.4 LTS RHSA-2019:0735-01 Critical: QMF Methods Risk

red hat
Calendar Grey April 9, 2019
Dist Redhat Esm H88
Red Hat unveils significant security patch for katello-installer-base targeting a severe vulnerability in Satellite 6.4.
An update for katello-installer-base which configures qpid-dispatch-router is now available for Red Hat Satellite 6.4 for RHEL 7

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For detailed instructions how to apply this update, refer to:

rver_and_content_hosts#updating_satellite_server_to_next_minor_version

Summary

The qpid-dispatch-router package provides remote host management functionality and is configured through the katello-installer-base package. Additional packages included contain enhancements to support the fix.
Security Fix(es):
* qpid-dispatch-router: QMF methods exposed to goferd via qdrouterd (CVE-2019-3845)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
This issue was discovered by Pavel Moravec (Red Hat).

Topics%20covered

Topics Covered

security advisory critical issue security impact Red Hat Satellite katello-installer-base qpid-dispatch-router

References

https://access.redhat.com/security/cve/CVE-2019-3845 https://access.redhat.com/security/updates/classification#important

Package List

Red Hat Satellite Capsule 6.4:
Source: katello-installer-base-3.7.0.19-1.el7sat.src.rpm satellite-6.4.2.1-1.el7sat.src.rpm
noarch: foreman-installer-katello-3.7.0.19-1.el7sat.noarch.rpm katello-installer-base-3.7.0.19-1.el7sat.noarch.rpm satellite-capsule-6.4.2.1-1.el7sat.noarch.rpm satellite-common-6.4.2.1-1.el7sat.noarch.rpm satellite-debug-tools-6.4.2.1-1.el7sat.noarch.rpm
Red Hat Satellite 6.4:
Source: katello-installer-base-3.7.0.19-1.el7sat.src.rpm satellite-6.4.2.1-1.el7sat.src.rpm
noarch: foreman-installer-katello-3.7.0.19-1.el7sat.noarch.rpm katello-installer-base-3.7.0.19-1.el7sat.noarch.rpm satellite-6.4.2.1-1.el7sat.noarch.rpm satellite-capsule-6.4.2.1-1.el7sat.noarch.rpm satellite-cli-6.4.2.1-1.el7sat.noarch.rpm satellite-common-6.4.2.1-1.el7sat.noarch.rpm satellite-debug-tools-6.4.2.1-1.el7sat.noarch.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key


Severity
important
Lowest
Low
Medium
High
Critical

Advisory ID: RHSA-2019:0735-01
Product: Red Hat Satellite 6
Advisory URL: https://access.redhat.com/errata/RHSA-2019:0735
Issue date: 2019-04-09

Topic

An update for katello-installer-base which configures qpid-dispatch-routeris now available for Red Hat Satellite 6.4 for RHEL 7.Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory critical issue security impact Red Hat Satellite katello-installer-base qpid-dispatch-router

Relevant Releases Architectures

Red Hat Satellite 6.4 - noarch

Red Hat Satellite Capsule 6.4 - noarch

Bugs Fixed

1684275 - CVE-2019-3845 qpid-dispatch-router: QMF methods exposed to goferd via qdrouterd

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here