Red Hat Update Infrastructure 4 for Cloud Providers.

Pulp-rpm: distribution tree publish creates directories from .treeinfo ids

• Red Hat Satellite 6
• Red Hat Update Infrastructure 4 for Cloud Providers
• Path traversal

Pulp-container: registry credentials are reused across remotes in a worker

• Red Hat Ansible Automation Platform 2
• Red Hat Satellite 6
• CWE-488

Pulpcore: pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read and pulp container registry signing key theft

• Red Hat Ansible Automation Platform 2.6 for RHEL 9
• Red Hat Ansible Automation Platform 2.6
• Path traversal

Pulpcore: python-pulpcore: stored cross-site scripting via inline rendering of uploaded html/svg content

• Red Hat Ansible Automation Platform 2
• Red Hat Satellite 6
• Cross-site scripting (XSS)

Libsolv: libsolv: out-of-bounds write in repo_write() via unvalidated directory id from vertical/paged .solv filelist data

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• CWE-129

Pulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexport

• Red Hat Ansible Automation Platform 2.5 for RHEL 8
• Red Hat Ansible Automation Platform 2.5 for RHEL 9
• Path traversal

Libsolv: stack-based buffer overflow in libsolv eddsa pgp signature verification allows denial of service

• OpenSUSE libsolv
• Red Hat Enterprise Linux 10
• Memory corruption

Libsolv: heap buffer overflow in libsolv repo_add_solv via negative maxsize from crafted .solv file

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Libsolv: stack-based buffer overflow in libsolv's debian metadata parser when handling sha384/sha512 checksums

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Puppet-pulpcore: an authentication bypass vulnerability exists in pulpcore

• Red Hat Satellite 6.13 for RHEL 8
• Red Hat Satellite 6.14 for RHEL 8
• Authentication bypass