PT-2014-2796 · Red Hat · Katello Installer

Dominic Cleal + 1 · Published 2014-05-14 · Updated 2014-05-15 · CVE-2013-4455

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Katello Installer versions prior to 0.0.18

Description The issue allows local users to obtain the private key by reading the file due to world-readable permissions for /etc/pki/tls/private/katello-node.key when deploying a child Pulp node.

Recommendations For versions prior to 0.0.18, update to version 0.0.18 or later to resolve the issue. As a temporary workaround, consider changing the permissions of the /etc/pki/tls/private/katello-node.key file to restrict access until the update is applied.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2013-4455

Affected Products

Katello Installer

References · 3

• 🔥 https://github.com/Katello/katello-installer/commit/15e01086bcb3f5d42525730e8b162bca11bec85e · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-4455 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1021784 · Note