Critical Vulnerability in python3.12-pulpcore and yggdrasil-worker-forwarder Packages: Red Hat Security Advisory RHSA-2026:42151
Summary
RHSA-2026:42151: Red Hat Security Advisory: Satellite 6.18.7.1 Async Update. Affects python3.12-pulpcore versions < 0:3.73.30-2.el9pc. Fixed in 0:3.73.30-2.el9pc. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The python3.12-pulpcore package is a core component of the Pulp project, which is designed for managing repositories of software packages. It provides a robust framework for content management and distribution. The yggdrasil-worker-forwarder package is utilized within the Red Hat Satellite ecosystem to facilitate communication between various components. Both packages are integral to the functionality of Red Hat Satellite 6.18, which is a system for managing software and systems across large infrastructures. This vulnerability exposes these packages to potential exploitation, affecting the overall security of systems relying on them.
Vulnerability Detail
The vulnerability identified in the python3.12-pulpcore and yggdrasil-worker-forwarder packages is critical, with a CVSS score of 9.1. It originates from improper handling of certain inputs, which could allow an attacker to execute arbitrary code or cause a denial of service. The ramifications of this vulnerability could lead to unauthorized access to sensitive data, disruption of services, and potential system compromise. It is crucial for users of these packages to understand the severity and take immediate action to mitigate risks.
How To Fix
Minimum fixed version
0:3.73.30-2.el9pc
This is the first release that contains the fix.
sudo dnf update python3.12-pulpcoreTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the affected services or implement network-level controls to limit exposure until the packages can be updated. Additionally, monitoring logs for unusual activity can help identify potential exploitation attempts.
Conclusion
In summary, the vulnerability in the python3.12-pulpcore and yggdrasil-worker-forwarder packages poses a significant risk to systems using Red Hat Satellite 6.18. It is essential for users to update their packages promptly to mitigate potential threats and ensure the security of their environments.
See every vulnerability recorded for python3.12-pulpcore →
FAQ
The CVSS score of this vulnerability is 9.1, indicating a critical level of severity.
The affected packages are python3.12-pulpcore and yggdrasil-worker-forwarder.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The potential consequences include unauthorized access to sensitive data, service disruption, and system compromise.
If immediate updates are not possible, consider implementing network-level controls and monitoring logs for unusual activity as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for python3.12-pulpcore.
