CVE-2019-3891

It was discovered that a world-readable log file belonging to Candlepin component of Red Hat Satellite 6.4 leaked the credentials of the Candlepin database. A malicious user with local access to a Satellite host can use those credentials to modify the database and prevent Satellite from fetching package updates, thus preventing all Satellite hosts from accessing those updates.

Score

CVSS 3.1 7.8 High

Status

Modified - secalert@redhat.com

Published

2019-04-15

Last modified

2024-08-04

Weaknesses

CWE-532

Affected products

• Candlepin (Red Hat)
• Satellite (Redhat)

References

• https://access.redhat.com/errata/RHSA-2019:1222
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3891