PT-2017-8492 · Red Hat+1 · Subscription-Manager+2

Cedric Buissart · Published 2016-11-03 · Updated 2023-02-12 · CVE-2016-4455

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Subscription Manager versions prior to 1.17.7-1

Description The issue concerns weak permissions set for cache directories in the Subscription Manager package, allowing local users to access sensitive information by reading files in these directories.

Recommendations For versions prior to 1.17.7-1, update to version 1.17.7-1 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CESA-2016_2592

CVE-2016-4455

RHSA-2016:2592

RHSA-2016_2592

RHSA-2017:0698

RHSA-2017_0698

Affected Products

Centos

Red Hat

Subscription-Manager

References · 23

• https://github.com/candlepin/subscription-manager/commit/9dec31 · Patch
• https://bugzilla.redhat.com/show_bug.cgi?id=1340525 · Patch
• http://rhn.redhat.com/errata/RHSA-2016-2592.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2017-0698.html · Vendor Advisory
• http://openwall.com/lists/oss-security/2016/10/26/5 · Patch
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4455 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-4455 · Security Note
• https://osv.dev/vulnerability/CVE-2016-4455 · Vendor Advisory
• https://github.com/candlepin/subscription-manager/blob/subscription-manager-1.17.7-1/subscription-manager.spec · Note
• https://access.redhat.com/errata/RHSA-2017:0698 · Note
• https://lists.centos.org/pipermail/centos-cr-announce/2016-November/029726.html · Note
• https://lists.centos.org/pipermail/centos-cr-announce/2016-November/016553.html · Note
• https://lists.centos.org/pipermail/centos-cr-announce/2016-November/029933.html · Note
• https://lists.centos.org/pipermail/centos-cr-announce/2016-November/023243.html · Note
• https://lists.centos.org/pipermail/centos-cr-announce/2016-November/003663.html · Note