PT-2019-13852 · Red Hat · Katello

CVE-2019-14825 · Publicado 2019-11-25 · Atualizado 2023-02-12

Positive Technologies (AI Summary)

CVSS v3.1

4.1

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Katello versions prior to 3.12.0.9

Description A cleartext password storage issue was discovered in Katello. Registry credentials used during container image discovery were inadvertently logged without being masked. This flaw could expose the registry credentials to other privileged users.

Recommendations For versions prior to 3.12.0.9, update to version 3.12.0.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the logs that contain the registry credentials to minimize the risk of exploitation.

Exploit

Correção

Cleartext Storage of Sensitive Information

Enumeração de Fraquezas

CWE-312

Identificadores relacionados

CVE-2019-14825

GHSA-M4WH-848J-9W2R

RHSA-2019:3172

Produtos afetados

Katello

Referências · 16

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/katello/CVE-2019-14825.yml · Exploit
• https://github.com/Katello/katello · Nota
• https://github.com/Katello/katello/commit/332484232b66b7907a8104a19ea97eb697b75c79 · Nota
• https://github.com/Katello/katello/pull/8244 · Nota
• https://github.com/Katello/katello/commits/3.12.2 · Nota
• https://github.com/Katello/katello/pull/8253 · Nota
• https://github.com/Katello/katello/commit/4eefa678a905140620ca8b390d48fe318d36e4ea · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=1730668 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=1739485 · Nota
• https://osv.dev/vulnerability/GHSA-m4wh-848j-9w2r · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2019:3172 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-14825 · Nota de Segurança
• https://projects.theforeman.org/issues/27485 · Nota
• https://osv.dev/vulnerability/CVE-2019-14825 · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2019-14825 · Nota