RHSA-2026:6291
Vulnerability from csaf_redhat - Published: 2026-03-31 16:56 - Updated: 2026-03-31 22:32Summary
Red Hat Security Advisory: General availability of the satellite/iop-advisor-backend-rhel9 container image
Severity
Important
Notes
Topic: A new satellite/iop-advisor-backend-rhel9 container image is now generally available in the Red Hat container registry.
Details: Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed packages, running services, and configuration settings. When you install Red Hat Lightspeed in Satellite locally, you can generate Red Hat Lightspeed recommendations without sending system data to Red Hat services.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Django. A remote attacker can exploit this vulnerability by sending a crafted request containing multiple duplicate headers to the ASGIRequest component. This can lead to a potential Denial of Service (DoS), making the affected system unavailable to legitimate users.
7.5 (High)
Vendor Fix
For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.
https://access.redhat.com/errata/RHSA-2026:6291
Workaround
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
A flaw was found in Django. A remote attacker could inject SQL commands by manipulating the band index parameter during raster lookups on `RasterField` (only implemented on PostGIS). This SQL injection vulnerability could lead to unauthorized information disclosure, data alteration, or denial of service.
8.3 (High)
Vendor Fix
For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.
https://access.redhat.com/errata/RHSA-2026:6291
Workaround
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
A flaw was found in Django. A remote attacker can exploit this vulnerability by providing crafted inputs containing a large number of unmatched HTML end tags to the `django.utils.text.Truncator.chars()` and `Truncator.words()` methods (when `html=True`), or through the `truncatechars_html` and `truncatewords_html` template filters. This can lead to a denial-of-service (DoS) condition, making the application unavailable to legitimate users.
7.5 (High)
Vendor Fix
For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.
https://access.redhat.com/errata/RHSA-2026:6291
Workaround
To mitigate this issue, applications utilizing Django should avoid processing untrusted HTML content through the `django.utils.text.Truncator.chars()` and `Truncator.words()` methods with `html=True`, or the `truncatechars_html` and `truncatewords_html` template filters. Restrict the use of these functions to only trusted inputs where the HTML structure is controlled and validated.
A flaw was found in Django. This vulnerability allows a remote attacker to perform SQL injection by using specially crafted control characters within column aliases. When these crafted aliases are passed through dictionary expansion to `QuerySet` methods like `annotate()` or `values()`, it can lead to the execution of arbitrary SQL commands. This could result in unauthorized access to sensitive data or modification of information within the database.
8.3 (High)
Vendor Fix
For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.
https://access.redhat.com/errata/RHSA-2026:6291
Workaround
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
A flaw was found in Django. A remote attacker could exploit a SQL injection vulnerability in the `.QuerySet.order_by()` method. This occurs when column aliases containing periods are used, and the same alias is also present in `FilteredRelation` via a specially crafted dictionary. Successful exploitation could lead to unauthorized information disclosure or arbitrary code execution within the database.
8.5 (High)
Vendor Fix
For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.
https://access.redhat.com/errata/RHSA-2026:6291
Workaround
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
References
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "A new satellite/iop-advisor-backend-rhel9 container image is now generally available in the Red Hat container registry.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed packages, running services, and configuration settings. When you install Red Hat Lightspeed in Satellite locally, you can generate Red Hat Lightspeed recommendations without sending system data to Red Hat services. ",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:6291",
"url": "https://access.redhat.com/errata/RHSA-2026:6291"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-us/red_hat_satellite/6.18/html/updating_red_hat_satellite/index",
"url": "https://access.redhat.com/documentation/en-us/red_hat_satellite/6.18/html/updating_red_hat_satellite/index"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-14550",
"url": "https://access.redhat.com/security/cve/CVE-2025-14550"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-1207",
"url": "https://access.redhat.com/security/cve/CVE-2026-1207"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-1285",
"url": "https://access.redhat.com/security/cve/CVE-2026-1285"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-1287",
"url": "https://access.redhat.com/security/cve/CVE-2026-1287"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-1312",
"url": "https://access.redhat.com/security/cve/CVE-2026-1312"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://catalog.redhat.com/software/containers/search",
"url": "https://catalog.redhat.com/software/containers/search"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.18/html/installing_satellite_server_in_a_connected_network_environment/performing-additional-configuration-on-server_satellite#installing-and-configuring-red-hat-lightspeed-in-satellite",
"url": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.18/html/installing_satellite_server_in_a_connected_network_environment/performing-additional-configuration-on-server_satellite#installing-and-configuring-red-hat-lightspeed-in-satellite"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.18/html/installing_satellite_server_in_a_disconnected_network_environment/performing-additional-configuration#installing-and-configuring-red-hat-lightspeed-in-satellite",
"url": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.18/html/installing_satellite_server_in_a_disconnected_network_environment/performing-additional-configuration#installing-and-configuring-red-hat-lightspeed-in-satellite"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_6291.json"
}
],
"title": "Red Hat Security Advisory: General availability of the satellite/iop-advisor-backend-rhel9 container image",
"tracking": {
"current_release_date": "2026-03-31T22:32:22+00:00",
"generator": {
"date": "2026-03-31T22:32:22+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.7.4"
}
},
"id": "RHSA-2026:6291",
"initial_release_date": "2026-03-31T16:56:50+00:00",
"revision_history": [
{
"date": "2026-03-31T16:56:50+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-03-31T16:56:57+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-03-31T22:32:22+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Satellite 6.18",
"product": {
"name": "Red Hat Satellite 6.18",
"product_id": "Red Hat Satellite 6.18",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:satellite:6.18::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat Satellite"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/satellite/iop-advisor-backend-rhel9@sha256:563d17f7250c9a5ccb9f7213332b0a8e0b876e8e4e9814a7f397e51972c60a2c_amd64",
"product": {
"name": "registry.redhat.io/satellite/iop-advisor-backend-rhel9@sha256:563d17f7250c9a5ccb9f7213332b0a8e0b876e8e4e9814a7f397e51972c60a2c_amd64",
"product_id": "registry.redhat.io/satellite/iop-advisor-backend-rhel9@sha256:563d17f7250c9a5ccb9f7213332b0a8e0b876e8e4e9814a7f397e51972c60a2c_amd64",
"product_identification_helper": {
"purl": "pkg:oci/iop-advisor-backend-rhel9@sha256%3A563d17f7250c9a5ccb9f7213332b0a8e0b876e8e4e9814a7f397e51972c60a2c?arch=amd64\u0026repository_url=registry.redhat.io/satellite\u0026tag=1773451075"
}
}
}
],
"category": "architecture",
"name": "amd64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/satellite/iop-advisor-backend-rhel9@sha256:563d17f7250c9a5ccb9f7213332b0a8e0b876e8e4e9814a7f397e51972c60a2c_amd64 as a component of Red Hat Satellite 6.18",
"product_id": "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-advisor-backend-rhel9@sha256:563d17f7250c9a5ccb9f7213332b0a8e0b876e8e4e9814a7f397e51972c60a2c_amd64"
},
"product_reference": "registry.redhat.io/satellite/iop-advisor-backend-rhel9@sha256:563d17f7250c9a5ccb9f7213332b0a8e0b876e8e4e9814a7f397e51972c60a2c_amd64",
"relates_to_product_reference": "Red Hat Satellite 6.18"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-14550",
"cwe": {
"id": "CWE-167",
"name": "Improper Handling of Additional Special Element"
},
"discovery_date": "2026-02-03T15:01:12.970018+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2436341"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Django. A remote attacker can exploit this vulnerability by sending a crafted request containing multiple duplicate headers to the ASGIRequest component. This can lead to a potential Denial of Service (DoS), making the affected system unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Django: Django: Denial of Service via crafted request with duplicate headers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This MODERATE impact denial-of-service flaw in Django affects Red Hat products utilizing the ASGIRequest component, such as Red Hat Ansible Automation Platform, Red Hat Discovery, and Red Hat Satellite. A remote attacker could send specially crafted requests containing duplicate headers, potentially rendering the affected system unavailable.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-advisor-backend-rhel9@sha256:563d17f7250c9a5ccb9f7213332b0a8e0b876e8e4e9814a7f397e51972c60a2c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-14550"
},
{
"category": "external",
"summary": "RHBZ#2436341",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436341"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-14550",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14550"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14550",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14550"
},
{
"category": "external",
"summary": "https://docs.djangoproject.com/en/dev/releases/security/",
"url": "https://docs.djangoproject.com/en/dev/releases/security/"
},
{
"category": "external",
"summary": "https://groups.google.com/g/django-announce",
"url": "https://groups.google.com/g/django-announce"
},
{
"category": "external",
"summary": "https://www.djangoproject.com/weblog/2026/feb/03/security-releases/",
"url": "https://www.djangoproject.com/weblog/2026/feb/03/security-releases/"
}
],
"release_date": "2026-02-03T14:38:15.875000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-03-31T16:56:50+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-advisor-backend-rhel9@sha256:563d17f7250c9a5ccb9f7213332b0a8e0b876e8e4e9814a7f397e51972c60a2c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6291"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-advisor-backend-rhel9@sha256:563d17f7250c9a5ccb9f7213332b0a8e0b876e8e4e9814a7f397e51972c60a2c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-advisor-backend-rhel9@sha256:563d17f7250c9a5ccb9f7213332b0a8e0b876e8e4e9814a7f397e51972c60a2c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Django: Django: Denial of Service via crafted request with duplicate headers"
},
{
"cve": "CVE-2026-1207",
"cwe": {
"id": "CWE-89",
"name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
},
"discovery_date": "2026-02-03T15:00:58.388707+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2436338"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Django. A remote attacker could inject SQL commands by manipulating the band index parameter during raster lookups on `RasterField` (only implemented on PostGIS). This SQL injection vulnerability could lead to unauthorized information disclosure, data alteration, or denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Django: Django: SQL Injection via RasterField band index parameter",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This IMPORTANT flaw affects Django\u0027s `RasterField` when utilized with PostGIS, allowing remote SQL injection via the band index parameter. Red Hat Ansible Automation Platform, Red Hat Discovery, Red Hat Satellite, Insights, and Ansible Services are impacted if configured to use Django with PostGIS `RasterField` lookups. Successful exploitation could lead to unauthorized data access, modification, or denial of service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-advisor-backend-rhel9@sha256:563d17f7250c9a5ccb9f7213332b0a8e0b876e8e4e9814a7f397e51972c60a2c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-1207"
},
{
"category": "external",
"summary": "RHBZ#2436338",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436338"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-1207",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1207"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1207",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1207"
},
{
"category": "external",
"summary": "https://docs.djangoproject.com/en/dev/releases/security/",
"url": "https://docs.djangoproject.com/en/dev/releases/security/"
},
{
"category": "external",
"summary": "https://groups.google.com/g/django-announce",
"url": "https://groups.google.com/g/django-announce"
},
{
"category": "external",
"summary": "https://www.djangoproject.com/weblog/2026/feb/03/security-releases/",
"url": "https://www.djangoproject.com/weblog/2026/feb/03/security-releases/"
}
],
"release_date": "2026-02-03T14:35:33.721000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-03-31T16:56:50+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-advisor-backend-rhel9@sha256:563d17f7250c9a5ccb9f7213332b0a8e0b876e8e4e9814a7f397e51972c60a2c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6291"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-advisor-backend-rhel9@sha256:563d17f7250c9a5ccb9f7213332b0a8e0b876e8e4e9814a7f397e51972c60a2c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-advisor-backend-rhel9@sha256:563d17f7250c9a5ccb9f7213332b0a8e0b876e8e4e9814a7f397e51972c60a2c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Django: Django: SQL Injection via RasterField band index parameter"
},
{
"cve": "CVE-2026-1285",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-02-03T15:01:06.283620+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2436340"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Django. A remote attacker can exploit this vulnerability by providing crafted inputs containing a large number of unmatched HTML end tags to the `django.utils.text.Truncator.chars()` and `Truncator.words()` methods (when `html=True`), or through the `truncatechars_html` and `truncatewords_html` template filters. This can lead to a denial-of-service (DoS) condition, making the application unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Django: Django: Denial of Service via crafted HTML inputs",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is a MODERATE impact denial-of-service flaw in Django. Applications utilizing Django that process untrusted HTML inputs with a large number of unmatched end tags through the `Truncator.chars()` or `Truncator.words()` methods (with `html=True`), or the `truncatechars_html` and `truncatewords_html` template filters, may experience resource exhaustion. This can lead to the application becoming unavailable.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-advisor-backend-rhel9@sha256:563d17f7250c9a5ccb9f7213332b0a8e0b876e8e4e9814a7f397e51972c60a2c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-1285"
},
{
"category": "external",
"summary": "RHBZ#2436340",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436340"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-1285",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1285"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1285",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1285"
},
{
"category": "external",
"summary": "https://docs.djangoproject.com/en/dev/releases/security/",
"url": "https://docs.djangoproject.com/en/dev/releases/security/"
},
{
"category": "external",
"summary": "https://groups.google.com/g/django-announce",
"url": "https://groups.google.com/g/django-announce"
},
{
"category": "external",
"summary": "https://www.djangoproject.com/weblog/2026/feb/03/security-releases/",
"url": "https://www.djangoproject.com/weblog/2026/feb/03/security-releases/"
}
],
"release_date": "2026-02-03T14:35:50.254000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-03-31T16:56:50+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-advisor-backend-rhel9@sha256:563d17f7250c9a5ccb9f7213332b0a8e0b876e8e4e9814a7f397e51972c60a2c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6291"
},
{
"category": "workaround",
"details": "To mitigate this issue, applications utilizing Django should avoid processing untrusted HTML content through the `django.utils.text.Truncator.chars()` and `Truncator.words()` methods with `html=True`, or the `truncatechars_html` and `truncatewords_html` template filters. Restrict the use of these functions to only trusted inputs where the HTML structure is controlled and validated.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-advisor-backend-rhel9@sha256:563d17f7250c9a5ccb9f7213332b0a8e0b876e8e4e9814a7f397e51972c60a2c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-advisor-backend-rhel9@sha256:563d17f7250c9a5ccb9f7213332b0a8e0b876e8e4e9814a7f397e51972c60a2c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Django: Django: Denial of Service via crafted HTML inputs"
},
{
"cve": "CVE-2026-1287",
"cwe": {
"id": "CWE-89",
"name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
},
"discovery_date": "2026-02-03T15:01:03.441713+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2436339"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Django. This vulnerability allows a remote attacker to perform SQL injection by using specially crafted control characters within column aliases. When these crafted aliases are passed through dictionary expansion to `QuerySet` methods like `annotate()` or `values()`, it can lead to the execution of arbitrary SQL commands. This could result in unauthorized access to sensitive data or modification of information within the database.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Django: Django: SQL Injection via crafted column aliases",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This IMPORTANT SQL injection flaw in Django allows a remote attacker to execute arbitrary SQL commands by crafting column aliases. This vulnerability affects Red Hat products that incorporate Django, such as Red Hat Ansible Automation Platform, Red Hat Discovery, Red Hat Satellite, Insights, and Ansible Services, potentially leading to unauthorized data access or modification.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-advisor-backend-rhel9@sha256:563d17f7250c9a5ccb9f7213332b0a8e0b876e8e4e9814a7f397e51972c60a2c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-1287"
},
{
"category": "external",
"summary": "RHBZ#2436339",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436339"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-1287",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1287"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1287",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1287"
},
{
"category": "external",
"summary": "https://docs.djangoproject.com/en/dev/releases/security/",
"url": "https://docs.djangoproject.com/en/dev/releases/security/"
},
{
"category": "external",
"summary": "https://groups.google.com/g/django-announce",
"url": "https://groups.google.com/g/django-announce"
},
{
"category": "external",
"summary": "https://www.djangoproject.com/weblog/2026/feb/03/security-releases/",
"url": "https://www.djangoproject.com/weblog/2026/feb/03/security-releases/"
}
],
"release_date": "2026-02-03T14:36:03.630000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-03-31T16:56:50+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-advisor-backend-rhel9@sha256:563d17f7250c9a5ccb9f7213332b0a8e0b876e8e4e9814a7f397e51972c60a2c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6291"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-advisor-backend-rhel9@sha256:563d17f7250c9a5ccb9f7213332b0a8e0b876e8e4e9814a7f397e51972c60a2c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-advisor-backend-rhel9@sha256:563d17f7250c9a5ccb9f7213332b0a8e0b876e8e4e9814a7f397e51972c60a2c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Django: Django: SQL Injection via crafted column aliases"
},
{
"cve": "CVE-2026-1312",
"cwe": {
"id": "CWE-89",
"name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
},
"discovery_date": "2026-02-03T15:01:18.274166+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2436342"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Django. A remote attacker could exploit a SQL injection vulnerability in the `.QuerySet.order_by()` method. This occurs when column aliases containing periods are used, and the same alias is also present in `FilteredRelation` via a specially crafted dictionary. Successful exploitation could lead to unauthorized information disclosure or arbitrary code execution within the database.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Django: Django: SQL injection via crafted column aliases in QuerySet.order_by()",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This IMPORTANT vulnerability in Django allows for SQL injection within the `QuerySet.order_by()` method. A remote attacker could exploit this by providing crafted column aliases that include periods, specifically when used with `FilteredRelation`. Successful exploitation may result in unauthorized information disclosure or arbitrary code execution against the underlying database. This affects Red Hat products that integrate Django, such as Red Hat Ansible Automation Platform and Red Hat Satellite.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-advisor-backend-rhel9@sha256:563d17f7250c9a5ccb9f7213332b0a8e0b876e8e4e9814a7f397e51972c60a2c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-1312"
},
{
"category": "external",
"summary": "RHBZ#2436342",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436342"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-1312",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1312"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1312",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1312"
},
{
"category": "external",
"summary": "https://docs.djangoproject.com/en/dev/releases/security/",
"url": "https://docs.djangoproject.com/en/dev/releases/security/"
},
{
"category": "external",
"summary": "https://groups.google.com/g/django-announce",
"url": "https://groups.google.com/g/django-announce"
},
{
"category": "external",
"summary": "https://www.djangoproject.com/weblog/2026/feb/03/security-releases/",
"url": "https://www.djangoproject.com/weblog/2026/feb/03/security-releases/"
}
],
"release_date": "2026-02-03T14:36:23.257000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-03-31T16:56:50+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-advisor-backend-rhel9@sha256:563d17f7250c9a5ccb9f7213332b0a8e0b876e8e4e9814a7f397e51972c60a2c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6291"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-advisor-backend-rhel9@sha256:563d17f7250c9a5ccb9f7213332b0a8e0b876e8e4e9814a7f397e51972c60a2c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-advisor-backend-rhel9@sha256:563d17f7250c9a5ccb9f7213332b0a8e0b876e8e4e9814a7f397e51972c60a2c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Django: Django: SQL injection via crafted column aliases in QuerySet.order_by()"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…