PT-2022-11396 · Red Hat+1 · Red Hat Satellite+1

Yadnyawalk Tale · Published 2022-07-05 · Updated 2023-02-12 · CVE-2021-4142

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Red Hat Satellite (affected versions not specified)

Description The Candlepin component of Red Hat Satellite was affected by an improper authentication flaw. Few factors could allow an attacker to use the SCA (simple content access) certificate for authentication with Candlepin.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

IDOR

Improper Authentication

Weakness Enumeration

CWE-639

CWE-287

Related Identifiers

CVE-2021-4142

RHSA-2022:0790

RHSA-2022:5498

RLSA-2022:5498

Affected Products

Red Hat Satellite

Rocky Linux

References · 483

• https://github.com/candlepin/candlepin/pull/3197 · Patch
• https://github.com/candlepin/candlepin/pull/3199 · Patch
• https://errata.rockylinux.org/RLSA-2022:5498 · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2021-4142 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2034346 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-4142 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-4142 · Security Note
• https://osv.dev/vulnerability/RLSA-2022:5498 · Vendor Advisory
• https://github.com/candlepin/candlepin/pull/3198 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1980166 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2026658 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2029807 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2073307 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1811166 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1942806 · Note