{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "A new satellite/iop-vulnerability-engine-rhel9 container image is now available as a Technology Preview in the Red Hat container registry.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Lightspeed in Satellite analyzes system health and configuration by applying  predefined rules to a small set of local data, such as installed packages,  running services, and configuration settings.  When you install Red Hat Lightspeed in Satellite locally,  you can generate Red Hat Lightspeed recommendations without  sending system data to Red Hat services. ",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:92620",
        "url": "https://access.redhat.com/errata/RHSA-2026:92620"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-us/red_hat_satellite/6.18/html/updating_red_hat_satellite/index",
        "url": "https://access.redhat.com/documentation/en-us/red_hat_satellite/6.18/html/updating_red_hat_satellite/index"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-110857",
        "url": "https://access.redhat.com/security/cve/CVE-2026-110857"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-84782",
        "url": "https://access.redhat.com/security/cve/CVE-2026-84782"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-87819",
        "url": "https://access.redhat.com/security/cve/CVE-2026-87819"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-93599",
        "url": "https://access.redhat.com/security/cve/CVE-2026-93599"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://catalog.redhat.com/software/containers/search",
        "url": "https://catalog.redhat.com/software/containers/search"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.18/html/installing_satellite_server_in_a_connected_network_environment/performing-additional-configuration-on-server_satellite#installing-and-configuring-red-hat-lightspeed-in-satellite",
        "url": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.18/html/installing_satellite_server_in_a_connected_network_environment/performing-additional-configuration-on-server_satellite#installing-and-configuring-red-hat-lightspeed-in-satellite"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.18/html/installing_satellite_server_in_a_disconnected_network_environment/performing-additional-configuration#installing-and-configuring-red-hat-lightspeed-in-satellite",
        "url": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.18/html/installing_satellite_server_in_a_disconnected_network_environment/performing-additional-configuration#installing-and-configuring-red-hat-lightspeed-in-satellite"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_92620.json"
      }
    ],
    "title": "Red Hat Security Advisory: satellite/iop-vulnerability-engine-rhel9 container image available as a Technology Preview",
    "tracking": {
      "current_release_date": "2026-11-01T18:53:52+00:00",
      "generator": {
        "date": "2026-11-01T18:53:52+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.4"
        }
      },
      "id": "RHSA-2026:92620",
      "initial_release_date": "2026-10-29T17:14:00+00:00",
      "revision_history": [
        {
          "date": "2026-10-29T17:14:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-29T17:14:04+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-11-01T18:53:52+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Satellite 6.18",
                "product": {
                  "name": "Red Hat Satellite 6.18",
                  "product_id": "Red Hat Satellite 6.18",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:satellite:6.18::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Satellite"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:4a57b227eeb2d3d391ff8c2b9754800b5e776bf93f4c53b4d629f626eb7af685_amd64",
                "product": {
                  "name": "registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:4a57b227eeb2d3d391ff8c2b9754800b5e776bf93f4c53b4d629f626eb7af685_amd64",
                  "product_id": "registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:4a57b227eeb2d3d391ff8c2b9754800b5e776bf93f4c53b4d629f626eb7af685_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/iop-vulnerability-engine-rhel9@sha256%3A4a57b227eeb2d3d391ff8c2b9754800b5e776bf93f4c53b4d629f626eb7af685?arch=amd64\u0026repository_url=registry.redhat.io/satellite/iop-vulnerability-engine-rhel9\u0026tag=1793014224"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:4a57b227eeb2d3d391ff8c2b9754800b5e776bf93f4c53b4d629f626eb7af685_amd64 as a component of Red Hat Satellite 6.18",
          "product_id": "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:4a57b227eeb2d3d391ff8c2b9754800b5e776bf93f4c53b4d629f626eb7af685_amd64"
        },
        "product_reference": "registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:4a57b227eeb2d3d391ff8c2b9754800b5e776bf93f4c53b4d629f626eb7af685_amd64",
        "relates_to_product_reference": "Red Hat Satellite 6.18"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-84782",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-09-18T19:58:21.939000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2537080"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSL. The Datagram Transport Layer Security (DTLS) retransmission mechanism fails to properly handle handshake message writes that are suspended before completion. A remote attacker could exploit this vulnerability during handshake message retransmission, causing OpenSSL to read past the message buffer or overwrite internal state required to resume writing. This issue can result in information disclosure through out-of-bounds memory reads or cause a Denial of Service (DoS) by crashing the process.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl: compat-openssl: openssl: Information disclosure via DTLS handshake retransmission",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as an Important severity because an unauthenticated network adversary can trigger process crashes or memory exposure without requiring local system privileges. Red Hat Enterprise Linux utilizes OpenSSL as the fundamental cryptographic provider across the operating system; however, overall exposure is limited because the flaw strictly affects software using Datagram Transport Layer Security (DTLS) over UDP under non-blocking I/O configurations. Standard TLS connections over TCP, which represent the typical deployment model for the majority of Red Hat workloads and system services, are unaffected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:4a57b227eeb2d3d391ff8c2b9754800b5e776bf93f4c53b4d629f626eb7af685_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-84782"
        },
        {
          "category": "external",
          "summary": "RHBZ#2537080",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2537080"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-84782",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-84782"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-84782",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84782"
        },
        {
          "category": "external",
          "summary": "https://openssl-library.org/news/vulnerabilities/#CVE-2026-84782",
          "url": "https://openssl-library.org/news/vulnerabilities/#CVE-2026-84782"
        }
      ],
      "release_date": "2026-09-29T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T17:14:00+00:00",
          "details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
          "product_ids": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:4a57b227eeb2d3d391ff8c2b9754800b5e776bf93f4c53b4d629f626eb7af685_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92620"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:4a57b227eeb2d3d391ff8c2b9754800b5e776bf93f4c53b4d629f626eb7af685_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "openssl: compat-openssl: openssl: Information disclosure via DTLS handshake retransmission"
    },
    {
      "cve": "CVE-2026-87819",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2026-09-09T11:31:19.834714+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2530742"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in GitPython. A remote attacker could exploit a regular expression denial of service (ReDoS) vulnerability by crafting a malicious commit object. Specifically, a malformed author field containing an unterminated angle bracket can cause excessive processing, leading to the exhaustion of CPU resources and a denial of service for over two minutes per commit access.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "GitPython: GitPython: Denial of Service via crafted commit author field",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A regular expression denial of service vulnerability was found in GitPython when processing commit author and committer fields. The Actor.name_email_regex pattern exhibits quadratic backtracking when encountering malformed author fields containing unterminated angle brackets. An attacker who can introduce a crafted commit object into a repository that is subsequently processed by a GitPython application can cause excessive CPU resource consumption, leading to denial of service for over two minutes per commit access. This requires the application to parse commits from untrusted sources such as public git servers, tarballs, or automated import tools.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:4a57b227eeb2d3d391ff8c2b9754800b5e776bf93f4c53b4d629f626eb7af685_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-87819"
        },
        {
          "category": "external",
          "summary": "RHBZ#2530742",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2530742"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-87819",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-87819"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87819",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87819"
        },
        {
          "category": "external",
          "summary": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-g5vv-9gxw-82hx",
          "url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-g5vv-9gxw-82hx"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/gitpython-before-3.1.60-denial-of-service-via-redos",
          "url": "https://www.vulncheck.com/advisories/gitpython-before-3.1.60-denial-of-service-via-redos"
        }
      ],
      "release_date": "2026-09-09T11:21:05.360000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T17:14:00+00:00",
          "details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
          "product_ids": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:4a57b227eeb2d3d391ff8c2b9754800b5e776bf93f4c53b4d629f626eb7af685_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92620"
        },
        {
          "category": "workaround",
          "details": "Update GitPython to version 3.1.60 or later. Validate and sanitize git repository sources before processing. Enable git fsck validation (receive.fsckObjects) on git servers to reject malformed commit objects. Implement length limits on commit metadata fields before processing.",
          "product_ids": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:4a57b227eeb2d3d391ff8c2b9754800b5e776bf93f4c53b4d629f626eb7af685_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:4a57b227eeb2d3d391ff8c2b9754800b5e776bf93f4c53b4d629f626eb7af685_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "GitPython: GitPython: Denial of Service via crafted commit author field"
    },
    {
      "cve": "CVE-2026-93599",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-09-22T18:32:06.471964+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2538431"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in rustls-webpki. A remote attacker, by influencing an application to parse a specially crafted Certificate Revocation List (CRL) that contains an empty `onlySomeReasons` value in its `issuingDistributionPoint` extension, could trigger a panic. This vulnerability leads to a denial of service (DoS) in applications that explicitly enable CRL revocation checking.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rustls-webpki: rustls-webpki: Denial of Service via crafted Certificate Revocation List",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Important because an unauthenticated remote attacker can cause an immediate denial of service by triggering an unhandled panic in network-facing services. Exploitation requires the consuming software to explicitly enable Certificate Revocation List (CRL) validation, a capability that is disabled by default in standard rustls configurations. Applications and services that actively ingest revocation lists from untrusted endpoints face service termination, whereas environments utilizing default certificate verification workflows remain unaffected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:4a57b227eeb2d3d391ff8c2b9754800b5e776bf93f4c53b4d629f626eb7af685_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-93599"
        },
        {
          "category": "external",
          "summary": "RHBZ#2538431",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2538431"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-93599",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-93599"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93599",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93599"
        },
        {
          "category": "external",
          "summary": "https://github.com/rustls/webpki/security/advisories/GHSA-82j2-j2ch-gfr8",
          "url": "https://github.com/rustls/webpki/security/advisories/GHSA-82j2-j2ch-gfr8"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/rustls-webpki-before-0.103.13-panic-via-empty-bit-string",
          "url": "https://www.vulncheck.com/advisories/rustls-webpki-before-0.103.13-panic-via-empty-bit-string"
        }
      ],
      "release_date": "2026-09-18T13:20:10.258000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T17:14:00+00:00",
          "details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
          "product_ids": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:4a57b227eeb2d3d391ff8c2b9754800b5e776bf93f4c53b4d629f626eb7af685_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92620"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:4a57b227eeb2d3d391ff8c2b9754800b5e776bf93f4c53b4d629f626eb7af685_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "rustls-webpki: rustls-webpki: Denial of Service via crafted Certificate Revocation List"
    },
    {
      "cve": "CVE-2026-110857",
      "cwe": {
        "id": "CWE-88",
        "name": "Improper Neutralization of Argument Delimiters in a Command"
      },
      "discovery_date": "2026-10-14T23:01:39.302092+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2552966"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in GitPython. A remote attacker can achieve arbitrary code execution by supplying specially crafted repository URLs that are processed without proper protocol validation. Because the library forwards untrusted URLs and input parameters to the underlying Git utility without adequate sanitization, an attacker can execute arbitrary system commands within the context of the host application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "GitPython: GitPython: Arbitrary code execution via unsafe URL protocol handling",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as having an Important impact for Red Hat products because an attacker capable of supplying unvalidated repository sources to automated platform tasks could achieve arbitrary code execution under the privileges of the executing service. While default configurations in modern underlying git tools restrict dangerous external transport helpers, environments operating on older platform stacks or custom configurations that permit extended transport protocols face elevated exposure. Exploitation is constrained to scenarios where the host application processes untrusted repository references or user-supplied command arguments without prior sanitization.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:4a57b227eeb2d3d391ff8c2b9754800b5e776bf93f4c53b4d629f626eb7af685_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-110857"
        },
        {
          "category": "external",
          "summary": "RHBZ#2552966",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2552966"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-110857",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-110857"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-110857",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110857"
        },
        {
          "category": "external",
          "summary": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-w8jc-g24h-crhw",
          "url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-w8jc-g24h-crhw"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/gitpython-before-3.2.0-command-execution-via-ls-remote-ext-urls",
          "url": "https://www.vulncheck.com/advisories/gitpython-before-3.2.0-command-execution-via-ls-remote-ext-urls"
        }
      ],
      "release_date": "2026-10-14T22:52:40.373000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T17:14:00+00:00",
          "details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
          "product_ids": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:4a57b227eeb2d3d391ff8c2b9754800b5e776bf93f4c53b4d629f626eb7af685_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92620"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:4a57b227eeb2d3d391ff8c2b9754800b5e776bf93f4c53b4d629f626eb7af685_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "GitPython: GitPython: Arbitrary code execution via unsafe URL protocol handling"
    }
  ]
}