Security
فارسی
All products

Red Hat Satellite 6/satellite:el8/puppetserver

Red Hat · Package
17 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)CVE-2026-54514 · GHSA-HGJ6-7826-R7M5 com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind MavenRed Hat Medium Fix reported
jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiationCVE-2026-54512 · GHSA-J3RV-43J4-C7QM com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind MavenRed Hat High Fix reported
Eclipse Jetty: HTTP Authority/Host mismatchCVE-2026-6790 · GHSA-7P3P-8QV8-M2VH org.eclipse.jetty:jetty-serverOpenShift Developer Tools and Services/jenkins MavenRed Hat Medium Fix reported
Eclipse Jetty Digest Authentication: ISO-8859-1 lossy encoding allows authentication bypass via character substitutionCVE-2026-10050 · GHSA-2FVJ-HGJ9-J2GR org.eclipse.jetty.ee8:jetty-ee8-securityorg.eclipse.jetty.ee9:jetty-ee9-security MavenRed Hat High Fix reported
jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategyCVE-2026-59888 · GHSA-3PJW-73GF-8QR5 com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind MavenRed Hat Medium Fix reported
jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnorePropertiesCVE-2026-54515 · GHSA-5JMJ-H7XM-6Q6V com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind MavenRed Hat Medium Fix reported
jackson-databind has @JsonView bypass for setterless creator propertiesCVE-2026-54517 · GHSA-5HH8-Q8HV-FR38 com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind MavenRed Hat Medium Fix reported
jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()CVE-2026-50193 · GHSA-3WRR-7QPF-2PRH com.fasterxml.jackson.core:jackson-databindOpenShift Developer Tools and Services/jenkins-2-plugins MavenRed Hat Medium Fix reported
Eclipse Jetty: Cross-Request Leakage for trailers on HTTP/1.1 keep-alive connectionsCVE-2026-10051 · GHSA-F4V5-65JJ-PCR2 org.eclipse.jetty:jetty-serverOpenShift Developer Tools and Services/jenkins MavenRed Hat Medium Fix reported
jackson-databind has a @JsonView bypass for unwrapped creator parametersCVE-2026-54518 · GHSA-RCQC-6CW3-H962 com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind MavenRed Hat Medium Fix reported
jackson-databind's renamed @JsonIgnore'd setters can deserialize via private fieldsCVE-2026-54516 · GHSA-9FXM-VC8V-HJ55 com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind MavenRed Hat Medium Fix reported
org.eclipse.jetty:jetty-http has different parsing of invalid URIsCVE-2025-11143 · GHSA-WJPW-4J6X-6RWH org.eclipse.jetty:jetty-httpOpenShift Developer Tools and Services/jenkins MavenRed Hat Low Fix reported
Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headersCVE-2025-48976 · GHSA-VV7R-C36W-3PRJ commons-fileupload:commons-fileuploadorg.apache.commons:commons-fileupload2-core MavenRed Hat High Fix reported
Jackson-core Vulnerable to Memory Disclosure via Source Snippet in JsonLocationCVE-2025-49128 · GHSA-WF8F-6423-GFXG com.fasterxml.jackson.core:jackson-coreCryostat 4/jackson-core MavenRed Hat Medium Fix reported
**UNSUPPORTED WHEN ASSIGNED** GzipHandler causes part of request body to be seen as request body of a separate requestCVE-2024-13009 · GHSA-Q4RV-GQ96-W7C5 org.eclipse.jetty:jetty-serverA-MQ Clients 2/jetty-server MavenRed Hat High Fix reported
JRuby-OpenSSL has hostname verification disabled by defaultCVE-2025-46551 · GHSA-72QJ-48G4-5XGX org.jruby:jrubyrubygems:jruby-openssl MavenRed HatRubyGems Medium Fix reported
logback-core: Logback-core: Arbitrary Code Execution via Malicious Configuration or Environment VariableCVE-2026-13006 Migration Toolkit for Applications 8/mta/mta-cli-rhel9Migration Toolkit for Applications 8/mta/mta-java-external-provider-rhel9 Red Hat Medium No fix reported