PT-2014-2796 · Red Hat · Katello Installer

Dominic Cleal + 1 · Publicado 2014-05-14 · Atualizado 2014-05-15 · CVE-2013-4455

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Katello Installer versions prior to 0.0.18

Description The issue allows local users to obtain the private key by reading the file due to world-readable permissions for /etc/pki/tls/private/katello-node.key when deploying a child Pulp node.

Recommendations For versions prior to 0.0.18, update to version 0.0.18 or later to resolve the issue. As a temporary workaround, consider changing the permissions of the /etc/pki/tls/private/katello-node.key file to restrict access until the update is applied.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2013-4455

Produtos afetados

Katello Installer

Referências · 3

• 🔥 https://github.com/Katello/katello-installer/commit/15e01086bcb3f5d42525730e8b162bca11bec85e · Exploit
• https://bugzilla.redhat.com/show_bug.cgi?id=1021784 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-4455 · Nota de Segurança