Action not permitted
Modal body text goes here.
cve-2012-6116
Vulnerability from cvelistv5
Published
2013-03-01 02:00
Modified
2024-08-06 21:28
Severity ?
EPSS score ?
Summary
modules/certs/manifests/config.pp in katello-configure before 1.3.3.pulpv2 in Katello uses weak permissions (666) for the Candlepin bootstrap RPM, which allows local users to modify the Candlepin CA certificate by writing to this file.
References
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-06T21:28:39.442Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://github.com/Katello/katello/commits/master/katello-configure/katello-configure.spec" }, { "name": "52774", "tags": [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred" ], "url": "http://secunia.com/advisories/52774" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://github.com/jsomara/katello/commit/65f1e42b7bda0f3410931c50598540d944d8bf0d" }, { "name": "RHSA-2013:0547", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "http://rhn.redhat.com/errata/RHSA-2013-0547.html" }, { "name": "RHSA-2013:0686", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "http://rhn.redhat.com/errata/RHSA-2013-0686.html" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "datePublic": "2013-01-22T00:00:00", "descriptions": [ { "lang": "en", "value": "modules/certs/manifests/config.pp in katello-configure before 1.3.3.pulpv2 in Katello uses weak permissions (666) for the Candlepin bootstrap RPM, which allows local users to modify the Candlepin CA certificate by writing to this file." } ], "problemTypes": [ { "descriptions": [ { "description": "n/a", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2013-04-04T09:00:00", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat" }, "references": [ { "tags": [ "x_refsource_CONFIRM" ], "url": "https://github.com/Katello/katello/commits/master/katello-configure/katello-configure.spec" }, { "name": "52774", "tags": [ "third-party-advisory", "x_refsource_SECUNIA" ], "url": "http://secunia.com/advisories/52774" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://github.com/jsomara/katello/commit/65f1e42b7bda0f3410931c50598540d944d8bf0d" }, { "name": "RHSA-2013:0547", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "http://rhn.redhat.com/errata/RHSA-2013-0547.html" }, { "name": "RHSA-2013:0686", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "http://rhn.redhat.com/errata/RHSA-2013-0686.html" } ] } }, "cveMetadata": { "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2012-6116", "datePublished": "2013-03-01T02:00:00", "dateReserved": "2012-12-06T00:00:00", "dateUpdated": "2024-08-06T21:28:39.442Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2012-6116\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2013-03-01T05:40:16.910\",\"lastModified\":\"2013-04-04T03:21:52.980\",\"vulnStatus\":\"Modified\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"modules/certs/manifests/config.pp in katello-configure before 1.3.3.pulpv2 in Katello uses weak permissions (666) for the Candlepin bootstrap RPM, which allows local users to modify the Candlepin CA certificate by writing to this file.\"},{\"lang\":\"es\",\"value\":\"modules/certs/manifests/config.pp en katello-configure antes de v1.3.3.pulpv2 en Katello usa permisos d\u00e9biles (666) para el Candlepin bootstrap RPM, que permite a usuarios locales modificar el certificado CA Candlepin escribiendo en este fichero.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:L/Au:N/C:N/I:P/A:N\",\"accessVector\":\"LOCAL\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\",\"baseScore\":2.1},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":3.9,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-264\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:katello:katello:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B029A7B4-A3BE-4AC8-A6D0-C8FC2552492D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:katello:katello-configure:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"1.3.2_pulpv2\",\"matchCriteriaId\":\"B46FF535-5CF9-4030-B586-FC99BFC114E4\"}]}]}],\"references\":[{\"url\":\"http://rhn.redhat.com/errata/RHSA-2013-0547.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2013-0686.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://secunia.com/advisories/52774\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://github.com/Katello/katello/commits/master/katello-configure/katello-configure.spec\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://github.com/jsomara/katello/commit/65f1e42b7bda0f3410931c50598540d944d8bf0d\",\"source\":\"secalert@redhat.com\"}]}}" } }
rhsa-2013_0686
Vulnerability from csaf_redhat
Published
2013-03-26 19:10
Modified
2024-11-05 18:04
Summary
Red Hat Security Advisory: Subscription Asset Manager 1.2.1 update
Notes
Topic
Red Hat Subscription Asset Manager 1.2.1, which fixes several security
issues, multiple bugs, and adds various enhancements, is now available.
The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.
Details
Red Hat Subscription Asset Manager acts as a proxy for handling
subscription information and software updates on client machines.
The latest packages for Subscription Asset Manager include a number of security fixes:
When a Subscription Asset Manager instance is created, its configuration
script automatically creates an RPM of the internal subscription service
CA certificate. However, this RPM incorrectly created the CA certificate
with file permissions of 0666. This allowed other users on a client system
to modify the CA certificate used to trust the remote subscription server.
All administrators are advised to update and deploy the subscription
service certificate on all systems which use Subscription Asset Manager
as their subscription service. This procedure is described in:
https://access.redhat.com/knowledge/docs/en-US/Red_Hat_Subscription_Asset_Manager/1.2/html/Installation_Guide/sect-Installation_Guide-Administration-Upgrading_Subscription_Asset_Manager.html
(CVE-2012-6116)
Manifest signature checking was not implemented for early versions of
Subscription Asset Manager. This meant that a malicious user could edit
a manifest file, insert arbitrary data, and successfully upload the edited
manifest file into the Subscription Asset Manager server. (CVE-2012-6119)
Ruby's documentation generator had a flaw in the way it generated HTML
documentation. When a Ruby application exposed its documentation
on a network (such as a web page), an attacker could use a specially-
crafted URL to open an arbitrary web script or to execute HTML code
within the application's user session. (CVE-2013-0256)
A timing attack flaw was found in the way rubygem-rack and
ruby193-rubygem-rack processed HMAC digests in cookies. This flaw could aid
an attacker using forged digital signatures to bypass authentication
checks. (CVE-2013-0263)
A flaw in rubygem-json allowed remote attacks by creating different types
of malicious objects. For example, it could initiate a denial of service
(DoS) attack through resource consumption by using a JSON document to
create arbitrary Ruby symbols, which were never garbage collected. It
could also be exploited to create internal objects which could allow a SQL
injection attack. (CVE-2013-0269)
A flaw in ActiveRecord in Ruby on Rails allowed remote attackers to
circumvent attribute protections and to insert their own crafted requests
to change protected attribute values. (CVE-2013-0276)
HTML markup was not properly escaped when filling in the username field in
the Notifications form of the Subscription Asset Manager UI. This meant
that HTML code used in the value was then applied in the UI page when the
entry was viewed. This could have allowed malicious HTML code to be
entered. The field value is now validated and any HTML tags are escaped.
(CVE-2013-1823)
These updated packages also include bug fixes and enhancements:
* Previously, no SELinux policy for the subscription service was included
with the Subscription Asset Manager packages. The candlepin-selinux package
is now included with SELinux policies for the subscription server.
(BZ#906901)
* When attempting to use the subscription service's CA certificate to
validate a manifest during import, the comparison failed. The upstream
subscription service which generated the manifest is a different service
than the local subscription service; thus, they have different CA
certificates. This caused importing a manifest to fail with the error
'archive failed signature'. This has been fixed so that the proper
certificate is used for verification. (BZ#918778)
All users of Subscription Asset Manager are recommended to update to the
latest packages.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Red Hat Subscription Asset Manager 1.2.1, which fixes several security\nissues, multiple bugs, and adds various enhancements, is now available.\n\nThe Red Hat Security Response Team has rated this update as having moderate\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat Subscription Asset Manager acts as a proxy for handling\nsubscription information and software updates on client machines.\n\nThe latest packages for Subscription Asset Manager include a number of security fixes:\n\nWhen a Subscription Asset Manager instance is created, its configuration\nscript automatically creates an RPM of the internal subscription service \nCA certificate. However, this RPM incorrectly created the CA certificate\nwith file permissions of 0666. This allowed other users on a client system\nto modify the CA certificate used to trust the remote subscription server.\nAll administrators are advised to update and deploy the subscription\nservice certificate on all systems which use Subscription Asset Manager\nas their subscription service. This procedure is described in:\nhttps://access.redhat.com/knowledge/docs/en-US/Red_Hat_Subscription_Asset_Manager/1.2/html/Installation_Guide/sect-Installation_Guide-Administration-Upgrading_Subscription_Asset_Manager.html\n(CVE-2012-6116)\n\nManifest signature checking was not implemented for early versions of \nSubscription Asset Manager. This meant that a malicious user could edit\na manifest file, insert arbitrary data, and successfully upload the edited\nmanifest file into the Subscription Asset Manager server. (CVE-2012-6119)\n\nRuby\u0027s documentation generator had a flaw in the way it generated HTML\ndocumentation. When a Ruby application exposed its documentation\non a network (such as a web page), an attacker could use a specially-\ncrafted URL to open an arbitrary web script or to execute HTML code\nwithin the application\u0027s user session. (CVE-2013-0256)\n\nA timing attack flaw was found in the way rubygem-rack and\nruby193-rubygem-rack processed HMAC digests in cookies. This flaw could aid\nan attacker using forged digital signatures to bypass authentication\nchecks. (CVE-2013-0263)\n\nA flaw in rubygem-json allowed remote attacks by creating different types\nof malicious objects. For example, it could initiate a denial of service\n(DoS) attack through resource consumption by using a JSON document to\ncreate arbitrary Ruby symbols, which were never garbage collected. It\ncould also be exploited to create internal objects which could allow a SQL\ninjection attack. (CVE-2013-0269)\n\nA flaw in ActiveRecord in Ruby on Rails allowed remote attackers to\ncircumvent attribute protections and to insert their own crafted requests\nto change protected attribute values. (CVE-2013-0276)\n\nHTML markup was not properly escaped when filling in the username field in\nthe Notifications form of the Subscription Asset Manager UI. This meant\nthat HTML code used in the value was then applied in the UI page when the\nentry was viewed. This could have allowed malicious HTML code to be\nentered. The field value is now validated and any HTML tags are escaped.\n(CVE-2013-1823)\n\nThese updated packages also include bug fixes and enhancements:\n\n* Previously, no SELinux policy for the subscription service was included\nwith the Subscription Asset Manager packages. The candlepin-selinux package\nis now included with SELinux policies for the subscription server. \n(BZ#906901)\n\n* When attempting to use the subscription service\u0027s CA certificate to\nvalidate a manifest during import, the comparison failed. The upstream\nsubscription service which generated the manifest is a different service\nthan the local subscription service; thus, they have different CA\ncertificates. This caused importing a manifest to fail with the error\n\u0027archive failed signature\u0027. This has been fixed so that the proper\ncertificate is used for verification. (BZ#918778)\n\nAll users of Subscription Asset Manager are recommended to update to the\nlatest packages.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2013:0686", "url": "https://access.redhat.com/errata/RHSA-2013:0686" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "906207", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=906207" }, { "category": "external", "summary": "906901", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=906901" }, { "category": "external", "summary": "907820", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=907820" }, { "category": "external", "summary": "908613", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=908613" }, { "category": "external", "summary": "909029", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=909029" }, { "category": "external", "summary": "909071", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=909071" }, { "category": "external", "summary": "909528", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=909528" }, { "category": "external", "summary": "918778", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=918778" }, { "category": "external", "summary": "918784", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=918784" }, { "category": "external", "summary": "922190", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=922190" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0686.json" } ], "title": "Red Hat Security Advisory: Subscription Asset Manager 1.2.1 update", "tracking": { "current_release_date": "2024-11-05T18:04:01+00:00", "generator": { "date": "2024-11-05T18:04:01+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2013:0686", "initial_release_date": "2013-03-26T19:10:00+00:00", "revision_history": [ { "date": "2013-03-26T19:10:00+00:00", "number": "1", "summary": "Initial version" }, { "date": "2013-03-26T19:16:44+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-05T18:04:01+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Subscription Asset Manager for RHEL 6 Server", "product": { "name": "Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12", "product_identification_helper": { "cpe": "cpe:/a:rhel_sam:1.2::el6" } } } ], "category": "product_family", "name": "Red Hat Subscription Asset Manager" }, { "branches": [ { "category": "product_version", "name": "rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "product": { "name": "rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "product_id": "rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-rails_warden-doc@0.5.5-2.el6cf?arch=noarch" } } }, { "category": "product_version", "name": "rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "product": { "name": "rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "product_id": "rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-rails_warden@0.5.5-2.el6cf?arch=noarch" } } }, { "category": "product_version", "name": "rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "product": { "name": "rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "product_id": "rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-delayed_job@2.1.4-3.el6cf?arch=noarch" } } }, { "category": "product_version", "name": "rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "product": { "name": "rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "product_id": "rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-delayed_job-doc@2.1.4-3.el6cf?arch=noarch" } } }, { "category": "product_version", "name": "rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "product": { "name": "rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "product_id": "rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-nokogiri-doc@1.5.0-0.9.beta4.el6cf?arch=noarch" } } }, { "category": "product_version", "name": "rubygem-actionpack-1:3.0.10-12.el6cf.noarch", "product": { "name": "rubygem-actionpack-1:3.0.10-12.el6cf.noarch", "product_id": "rubygem-actionpack-1:3.0.10-12.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-actionpack@3.0.10-12.el6cf?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "candlepin-0:0.7.24-1.el6_3.noarch", "product": { "name": "candlepin-0:0.7.24-1.el6_3.noarch", "product_id": "candlepin-0:0.7.24-1.el6_3.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/candlepin@0.7.24-1.el6_3?arch=noarch" } } }, { "category": "product_version", "name": "candlepin-tomcat6-0:0.7.24-1.el6_3.noarch", "product": { "name": "candlepin-tomcat6-0:0.7.24-1.el6_3.noarch", "product_id": "candlepin-tomcat6-0:0.7.24-1.el6_3.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/candlepin-tomcat6@0.7.24-1.el6_3?arch=noarch" } } }, { "category": "product_version", "name": "candlepin-selinux-0:0.7.24-1.el6_3.noarch", "product": { "name": "candlepin-selinux-0:0.7.24-1.el6_3.noarch", "product_id": "candlepin-selinux-0:0.7.24-1.el6_3.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/candlepin-selinux@0.7.24-1.el6_3?arch=noarch" } } }, { "category": "product_version", "name": "candlepin-devel-0:0.7.24-1.el6_3.noarch", "product": { "name": "candlepin-devel-0:0.7.24-1.el6_3.noarch", "product_id": "candlepin-devel-0:0.7.24-1.el6_3.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/candlepin-devel@0.7.24-1.el6_3?arch=noarch" } } }, { "category": "product_version", "name": "rubygem-rack-1:1.3.0-4.el6cf.noarch", "product": { "name": "rubygem-rack-1:1.3.0-4.el6cf.noarch", "product_id": "rubygem-rack-1:1.3.0-4.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-rack@1.3.0-4.el6cf?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch", "product": { "name": "rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch", "product_id": "rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-activemodel-doc@3.0.10-3.el6cf?arch=noarch" } } }, { "category": "product_version", "name": "rubygem-activemodel-0:3.0.10-3.el6cf.noarch", "product": { "name": "rubygem-activemodel-0:3.0.10-3.el6cf.noarch", "product_id": "rubygem-activemodel-0:3.0.10-3.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-activemodel@3.0.10-3.el6cf?arch=noarch" } } }, { "category": "product_version", "name": "rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "product": { "name": "rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "product_id": "rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-rdoc-doc@3.8-6.el6cf?arch=noarch" } } }, { "category": "product_version", "name": "rubygem-rdoc-0:3.8-6.el6cf.noarch", "product": { "name": "rubygem-rdoc-0:3.8-6.el6cf.noarch", "product_id": "rubygem-rdoc-0:3.8-6.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-rdoc@3.8-6.el6cf?arch=noarch" } } }, { "category": "product_version", "name": "katello-headpin-0:1.2.1.1-1h.el6_4.noarch", "product": { "name": "katello-headpin-0:1.2.1.1-1h.el6_4.noarch", "product_id": "katello-headpin-0:1.2.1.1-1h.el6_4.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/katello-headpin@1.2.1.1-1h.el6_4?arch=noarch" } } }, { "category": "product_version", "name": "katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch", "product": { "name": "katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch", "product_id": "katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/katello-glue-candlepin@1.2.1.1-1h.el6_4?arch=noarch" } } }, { "category": "product_version", "name": "katello-common-0:1.2.1.1-1h.el6_4.noarch", "product": { "name": "katello-common-0:1.2.1.1-1h.el6_4.noarch", "product_id": "katello-common-0:1.2.1.1-1h.el6_4.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/katello-common@1.2.1.1-1h.el6_4?arch=noarch" } } }, { "category": "product_version", "name": "katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch", "product": { "name": "katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch", "product_id": "katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/katello-headpin-all@1.2.1.1-1h.el6_4?arch=noarch" } } }, { "category": "product_version", "name": "thumbslug-0:0.0.28.1-1.el6_4.noarch", "product": { "name": "thumbslug-0:0.0.28.1-1.el6_4.noarch", "product_id": "thumbslug-0:0.0.28.1-1.el6_4.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/thumbslug@0.0.28.1-1.el6_4?arch=noarch" } } }, { "category": "product_version", "name": "thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch", "product": { "name": "thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch", "product_id": "thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/thumbslug-selinux@0.0.28.1-1.el6_4?arch=noarch" } } }, { "category": "product_version", "name": "katello-configure-0:1.2.3.1-4h.el6_4.noarch", "product": { "name": "katello-configure-0:1.2.3.1-4h.el6_4.noarch", "product_id": "katello-configure-0:1.2.3.1-4h.el6_4.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/katello-configure@1.2.3.1-4h.el6_4?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "rubygem-rails_warden-0:0.5.5-2.el6cf.src", "product": { "name": "rubygem-rails_warden-0:0.5.5-2.el6cf.src", "product_id": "rubygem-rails_warden-0:0.5.5-2.el6cf.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-rails_warden@0.5.5-2.el6cf?arch=src" } } }, { "category": "product_version", "name": "rubygem-delayed_job-0:2.1.4-3.el6cf.src", "product": { "name": "rubygem-delayed_job-0:2.1.4-3.el6cf.src", "product_id": "rubygem-delayed_job-0:2.1.4-3.el6cf.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-delayed_job@2.1.4-3.el6cf?arch=src" } } }, { "category": "product_version", "name": "rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "product": { "name": "rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "product_id": "rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-nokogiri@1.5.0-0.9.beta4.el6cf?arch=src" } } }, { "category": "product_version", "name": "rubygem-actionpack-1:3.0.10-12.el6cf.src", "product": { "name": "rubygem-actionpack-1:3.0.10-12.el6cf.src", "product_id": "rubygem-actionpack-1:3.0.10-12.el6cf.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-actionpack@3.0.10-12.el6cf?arch=src\u0026epoch=1" } } }, { "category": "product_version", "name": "candlepin-0:0.7.24-1.el6_3.src", "product": { "name": "candlepin-0:0.7.24-1.el6_3.src", "product_id": "candlepin-0:0.7.24-1.el6_3.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/candlepin@0.7.24-1.el6_3?arch=src" } } }, { "category": "product_version", "name": "rubygem-rack-1:1.3.0-4.el6cf.src", "product": { "name": "rubygem-rack-1:1.3.0-4.el6cf.src", "product_id": "rubygem-rack-1:1.3.0-4.el6cf.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-rack@1.3.0-4.el6cf?arch=src\u0026epoch=1" } } }, { "category": "product_version", "name": "rubygem-activemodel-0:3.0.10-3.el6cf.src", "product": { "name": "rubygem-activemodel-0:3.0.10-3.el6cf.src", "product_id": "rubygem-activemodel-0:3.0.10-3.el6cf.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-activemodel@3.0.10-3.el6cf?arch=src" } } }, { "category": "product_version", "name": "rubygem-rdoc-0:3.8-6.el6cf.src", "product": { "name": "rubygem-rdoc-0:3.8-6.el6cf.src", "product_id": "rubygem-rdoc-0:3.8-6.el6cf.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-rdoc@3.8-6.el6cf?arch=src" } } }, { "category": "product_version", "name": "katello-0:1.2.1.1-1h.el6_4.src", "product": { "name": "katello-0:1.2.1.1-1h.el6_4.src", "product_id": "katello-0:1.2.1.1-1h.el6_4.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/katello@1.2.1.1-1h.el6_4?arch=src" } } }, { "category": "product_version", "name": "rubygem-json-0:1.7.3-2.el6_3.src", "product": { "name": "rubygem-json-0:1.7.3-2.el6_3.src", "product_id": "rubygem-json-0:1.7.3-2.el6_3.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-json@1.7.3-2.el6_3?arch=src" } } }, { "category": "product_version", "name": "thumbslug-0:0.0.28.1-1.el6_4.src", "product": { "name": "thumbslug-0:0.0.28.1-1.el6_4.src", "product_id": "thumbslug-0:0.0.28.1-1.el6_4.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/thumbslug@0.0.28.1-1.el6_4?arch=src" } } }, { "category": "product_version", "name": "katello-configure-0:1.2.3.1-4h.el6_4.src", "product": { "name": "katello-configure-0:1.2.3.1-4h.el6_4.src", "product_id": "katello-configure-0:1.2.3.1-4h.el6_4.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/katello-configure@1.2.3.1-4h.el6_4?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "product": { "name": "rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "product_id": "rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-nokogiri-debuginfo@1.5.0-0.9.beta4.el6cf?arch=x86_64" } } }, { "category": "product_version", "name": "rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "product": { "name": "rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "product_id": "rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-nokogiri@1.5.0-0.9.beta4.el6cf?arch=x86_64" } } }, { "category": "product_version", "name": "ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "product": { "name": "ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "product_id": "ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby-nokogiri@1.5.0-0.9.beta4.el6cf?arch=x86_64" } } }, { "category": "product_version", "name": "rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64", "product": { "name": "rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64", "product_id": "rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-json-debuginfo@1.7.3-2.el6_3?arch=x86_64" } } }, { "category": "product_version", "name": "rubygem-json-0:1.7.3-2.el6_3.x86_64", "product": { "name": "rubygem-json-0:1.7.3-2.el6_3.x86_64", "product_id": "rubygem-json-0:1.7.3-2.el6_3.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-json@1.7.3-2.el6_3?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "candlepin-0:0.7.24-1.el6_3.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch" }, "product_reference": "candlepin-0:0.7.24-1.el6_3.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "candlepin-0:0.7.24-1.el6_3.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src" }, "product_reference": "candlepin-0:0.7.24-1.el6_3.src", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "candlepin-devel-0:0.7.24-1.el6_3.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch" }, "product_reference": "candlepin-devel-0:0.7.24-1.el6_3.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "candlepin-selinux-0:0.7.24-1.el6_3.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch" }, "product_reference": "candlepin-selinux-0:0.7.24-1.el6_3.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "candlepin-tomcat6-0:0.7.24-1.el6_3.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch" }, "product_reference": "candlepin-tomcat6-0:0.7.24-1.el6_3.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "katello-0:1.2.1.1-1h.el6_4.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src" }, "product_reference": "katello-0:1.2.1.1-1h.el6_4.src", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "katello-common-0:1.2.1.1-1h.el6_4.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch" }, "product_reference": "katello-common-0:1.2.1.1-1h.el6_4.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "katello-configure-0:1.2.3.1-4h.el6_4.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch" }, "product_reference": "katello-configure-0:1.2.3.1-4h.el6_4.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "katello-configure-0:1.2.3.1-4h.el6_4.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src" }, "product_reference": "katello-configure-0:1.2.3.1-4h.el6_4.src", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch" }, "product_reference": "katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "katello-headpin-0:1.2.1.1-1h.el6_4.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch" }, "product_reference": "katello-headpin-0:1.2.1.1-1h.el6_4.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch" }, "product_reference": "katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64 as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64" }, "product_reference": "ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-actionpack-1:3.0.10-12.el6cf.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch" }, "product_reference": "rubygem-actionpack-1:3.0.10-12.el6cf.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-actionpack-1:3.0.10-12.el6cf.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src" }, "product_reference": "rubygem-actionpack-1:3.0.10-12.el6cf.src", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-activemodel-0:3.0.10-3.el6cf.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch" }, "product_reference": "rubygem-activemodel-0:3.0.10-3.el6cf.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-activemodel-0:3.0.10-3.el6cf.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src" }, "product_reference": "rubygem-activemodel-0:3.0.10-3.el6cf.src", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch" }, "product_reference": "rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-delayed_job-0:2.1.4-3.el6cf.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch" }, "product_reference": "rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-delayed_job-0:2.1.4-3.el6cf.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src" }, "product_reference": "rubygem-delayed_job-0:2.1.4-3.el6cf.src", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch" }, "product_reference": "rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-json-0:1.7.3-2.el6_3.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src" }, "product_reference": "rubygem-json-0:1.7.3-2.el6_3.src", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-json-0:1.7.3-2.el6_3.x86_64 as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64" }, "product_reference": "rubygem-json-0:1.7.3-2.el6_3.x86_64", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64 as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64" }, "product_reference": "rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src" }, "product_reference": "rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64 as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64" }, "product_reference": "rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64 as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64" }, "product_reference": "rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch" }, "product_reference": "rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-rack-1:1.3.0-4.el6cf.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch" }, "product_reference": "rubygem-rack-1:1.3.0-4.el6cf.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-rack-1:1.3.0-4.el6cf.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src" }, "product_reference": "rubygem-rack-1:1.3.0-4.el6cf.src", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-rails_warden-0:0.5.5-2.el6cf.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch" }, "product_reference": "rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-rails_warden-0:0.5.5-2.el6cf.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src" }, "product_reference": "rubygem-rails_warden-0:0.5.5-2.el6cf.src", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch" }, "product_reference": "rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-rdoc-0:3.8-6.el6cf.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch" }, "product_reference": "rubygem-rdoc-0:3.8-6.el6cf.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-rdoc-0:3.8-6.el6cf.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src" }, "product_reference": "rubygem-rdoc-0:3.8-6.el6cf.src", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-rdoc-doc-0:3.8-6.el6cf.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch" }, "product_reference": "rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "thumbslug-0:0.0.28.1-1.el6_4.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch" }, "product_reference": "thumbslug-0:0.0.28.1-1.el6_4.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "thumbslug-0:0.0.28.1-1.el6_4.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src" }, "product_reference": "thumbslug-0:0.0.28.1-1.el6_4.src", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch" }, "product_reference": "thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "Dominic Cleal" ] }, { "names": [ "James Laska" ], "organization": "Red Hat", "summary": "This issue was discovered by Red Hat." } ], "cve": "CVE-2012-6116", "discovery_date": "2012-11-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "906207" } ], "notes": [ { "category": "description", "text": "modules/certs/manifests/config.pp in katello-configure before 1.3.3.pulpv2 in Katello uses weak permissions (666) for the Candlepin bootstrap RPM, which allows local users to modify the Candlepin CA certificate by writing to this file.", "title": "Vulnerability description" }, { "category": "summary", "text": "Candlepin: bootstrap RPM deploys CA certificate file with mode 666", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src", "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src", "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2012-6116" }, { "category": "external", "summary": "RHBZ#906207", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=906207" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2012-6116", "url": "https://www.cve.org/CVERecord?id=CVE-2012-6116" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-6116", "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6116" } ], "release_date": "2013-02-21T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2013-03-26T19:10:00+00:00", "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258", "product_ids": [ "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src", "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src", "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2013:0686" } ], "scores": [ { "cvss_v2": { "accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0" }, "products": [ "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src", "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src", "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Candlepin: bootstrap RPM deploys CA certificate file with mode 666" }, { "cve": "CVE-2012-6119", "discovery_date": "2013-02-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "908613" } ], "notes": [ { "category": "description", "text": "Candlepin before 0.7.24, as used in Red Hat Subscription Asset Manager before 1.2.1, does not properly check manifest signatures, which allows local users to modify manifests.", "title": "Vulnerability description" }, { "category": "summary", "text": "Candlepin: Re-enable manifest signature checking", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src", "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src", "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2012-6119" }, { "category": "external", "summary": "RHBZ#908613", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=908613" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2012-6119", "url": "https://www.cve.org/CVERecord?id=CVE-2012-6119" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-6119", "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6119" } ], "release_date": "2012-06-27T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2013-03-26T19:10:00+00:00", "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258", "product_ids": [ "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src", "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src", "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2013:0686" } ], "scores": [ { "cvss_v2": { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", "version": "2.0" }, "products": [ "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src", "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src", "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Candlepin: Re-enable manifest signature checking" }, { "acknowledgments": [ { "names": [ "Eric Hodel" ], "organization": "RDoc upstream" }, { "names": [ "Evgeny Ermakov" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2013-0256", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2013-02-05T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "907820" } ], "notes": [ { "category": "description", "text": "darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.", "title": "Vulnerability description" }, { "category": "summary", "text": "rubygem-rdoc: Cross-site scripting in the documentation created by Darkfish Rdoc HTML generator / template", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src", "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src", "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2013-0256" }, { "category": "external", "summary": "RHBZ#907820", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=907820" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2013-0256", "url": "https://www.cve.org/CVERecord?id=CVE-2013-0256" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-0256", "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0256" }, { "category": "external", "summary": "http://www.ruby-lang.org/en/news/2013/02/06/rdoc-xss-cve-2013-0256/", "url": "http://www.ruby-lang.org/en/news/2013/02/06/rdoc-xss-cve-2013-0256/" } ], "release_date": "2013-02-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2013-03-26T19:10:00+00:00", "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258", "product_ids": [ "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src", "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src", "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2013:0686" } ], "scores": [ { "cvss_v2": { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0" }, "products": [ "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src", "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src", "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "rubygem-rdoc: Cross-site scripting in the documentation created by Darkfish Rdoc HTML generator / template" }, { "cve": "CVE-2013-0263", "discovery_date": "2013-02-08T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "909071" } ], "notes": [ { "category": "description", "text": "Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time.", "title": "Vulnerability description" }, { "category": "summary", "text": "rubygem-rack: Timing attack in cookie sessions", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src", "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src", "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2013-0263" }, { "category": "external", "summary": "RHBZ#909071", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=909071" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2013-0263", "url": "https://www.cve.org/CVERecord?id=CVE-2013-0263" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-0263", "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0263" } ], "release_date": "2013-02-08T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2013-03-26T19:10:00+00:00", "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258", "product_ids": [ "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src", "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src", "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2013:0686" } ], "scores": [ { "cvss_v2": { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0" }, "products": [ "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src", "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src", "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "rubygem-rack: Timing attack in cookie sessions" }, { "acknowledgments": [ { "names": [ "Ruby on Rails upstream" ] }, { "names": [ "Thomas Hollstegge" ], "organization": "Zweitag", "summary": "Acknowledged by upstream." }, { "names": [ "Ben Murphy" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2013-0269", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2013-02-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "909029" } ], "notes": [ { "category": "description", "text": "The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka \"Unsafe Object Creation Vulnerability.\"", "title": "Vulnerability description" }, { "category": "summary", "text": "rubygem-json: Denial of Service and SQL Injection", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Satellite tools ship RubyGem Json 1.4.6 which is earlier than affected 1.5.5 version however, this version of RubyGem is not affected to the flaw. We may update RubyGem in a future release.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src", "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src", "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2013-0269" }, { "category": "external", "summary": "RHBZ#909029", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=909029" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2013-0269", "url": "https://www.cve.org/CVERecord?id=CVE-2013-0269" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-0269", "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0269" }, { "category": "external", "summary": "http://www.ruby-lang.org/en/news/2013/02/22/json-dos-cve-2013-0269/", "url": "http://www.ruby-lang.org/en/news/2013/02/22/json-dos-cve-2013-0269/" } ], "release_date": "2013-02-11T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2013-03-26T19:10:00+00:00", "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258", "product_ids": [ "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src", "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src", "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2013:0686" } ], "scores": [ { "cvss_v2": { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0" }, "products": [ "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src", "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src", "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "rubygem-json: Denial of Service and SQL Injection" }, { "cve": "CVE-2013-0276", "discovery_date": "2013-02-08T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "909528" } ], "notes": [ { "category": "description", "text": "ActiveRecord in Ruby on Rails before 2.3.17, 3.1.x before 3.1.11, and 3.2.x before 3.2.12 allows remote attackers to bypass the attr_protected protection mechanism and modify protected model attributes via a crafted request.", "title": "Vulnerability description" }, { "category": "summary", "text": "rubygem-activerecord/rubygem-activemodel: circumvention of attr_protected", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src", "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src", "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2013-0276" }, { "category": "external", "summary": "RHBZ#909528", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=909528" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2013-0276", "url": "https://www.cve.org/CVERecord?id=CVE-2013-0276" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-0276", "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0276" } ], "release_date": "2013-02-11T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2013-03-26T19:10:00+00:00", "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258", "product_ids": [ "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src", "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src", "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2013:0686" } ], "scores": [ { "cvss_v2": { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0" }, "products": [ "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src", "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src", "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "rubygem-activerecord/rubygem-activemodel: circumvention of attr_protected" }, { "acknowledgments": [ { "names": [ "Sureshkumar Thirugnanasambandan" ], "organization": "Red Hat Quality Engineering Team", "summary": "This issue was discovered by Red Hat." } ], "cve": "CVE-2013-1823", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2013-02-12T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "918784" } ], "notes": [ { "category": "description", "text": "Cross-site scripting (XSS) vulnerability in the Notifications form in Red Hat Subscription Asset Manager before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the username field.", "title": "Vulnerability description" }, { "category": "summary", "text": "Katello: Notifications page Username XSS", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src", "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src", "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2013-1823" }, { "category": "external", "summary": "RHBZ#918784", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=918784" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2013-1823", "url": "https://www.cve.org/CVERecord?id=CVE-2013-1823" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-1823", "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1823" } ], "release_date": "2013-03-26T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2013-03-26T19:10:00+00:00", "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258", "product_ids": [ "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src", "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src", "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2013:0686" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0" }, "products": [ "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src", "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src", "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "Katello: Notifications page Username XSS" } ] }
rhsa-2013_0547
Vulnerability from csaf_redhat
Published
2013-02-21 18:55
Modified
2024-11-05 18:00
Summary
Red Hat Security Advisory: CloudForms System Engine 1.1.2 update
Notes
Topic
CloudForms System Engine 1.1.2 is now available.
The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.
Details
Red Hat CloudForms is an on-premise hybrid cloud
Infrastructure-as-a-Service (IaaS) product that lets you create and manage
private and public clouds. It provides self-service computing resources to
users in a managed, governed, and secure way. CloudForms System Engine can
be used to configure new systems, subscribe to updates, and maintain
installations in distributed environments.
It was found that the
"/usr/share/katello/script/katello-generate-passphrase" utility, which is
run during the installation and configuration process, set world-readable
permissions on the "/etc/katello/secure/passphrase" file. A local attacker
could use this flaw to obtain the passphrase for Katello, giving them
access to information they would otherwise not have access to.
(CVE-2012-5561)
Note: After installing this update, ensure the
"/etc/katello/secure/passphrase" file is owned by the root user and group
and mode 0750 permissions. Sites should also consider re-creating the
Katello passphrase as this issue exposed it to local users.
One task the katello-configure utility performs is creating an RPM to be
installed on client machines that need to connect to the Katello server. It
was found that this RPM set world-readable and writable permissions on the
pem file (containing the Certificate Authority certificate) used for
trusting the Katello server. An attacker could use this flaw to perform a
man-in-the-middle attack, allowing them to manage (such as installing and
removing software) Katello client systems. (CVE-2012-6116)
The CVE-2012-5561 issue was discovered by Aaron Weitekamp of the Red Hat
Cloud Quality Engineering team, and CVE-2012-6116 was discovered by Dominic
Cleal and James Laska of Red Hat.
This update also fixes the following bugs:
* The CloudForms System Engine command line tool incorrectly parsed
locales, which caused the following error:
"translation missing: de.activerecord.errors.messages.record_invalid"
This update replaces the controller for setting the locale. The translation
error no longer appears. (BZ#896251)
* Certain locales did not properly escape certain UI content for new role
creation. This broke the Save button for some locales. This update corrects
the escape behavior for localized UI content. The Save button now works
for new role creation. (BZ#896252)
* A missing icon stopped users from deleting recent or saved searches. This
update adds the icon and users can now delete recent or saved searches.
(BZ#896253)
* A performance issue in the Candlepin 0.7.8 component caused subscription
responsiveness to decrease as the number of systems subscribed to
CloudForms System Engine increases. This erratum updates to Candlepin
0.7.19, which corrects the performance issues. (BZ#896261)
* CloudForms System Engine would not fetch Extended Update Service (EUS)
entitlements. This blocked the user from seeing and enabling EUS
repositories. This update revises the manifest upload and deletion code,
which also corrects the behavior for fetching entitlements. System Engine
now fetches EUS entitlements. (BZ#896265)
* Issues with menu widths caused the localized UI to not render certain
menu items. This update corrects the style for the System Engine UI. The
Web UI now renders the menu items correctly. (BZ#903702)
Refer to the CloudForms 1.1.2 Release Notes for further information about
this release. The Release Notes will be available shortly from
https://access.redhat.com/knowledge/docs/
To upgrade, follow the upgrade instructions in the CloudForms Installation
Guide, section "4.1. Upgrading CloudForms System Engine":
https://access.redhat.com/knowledge/docs/en-US/CloudForms/1.1/html/Installation_Guide/index.html
Users of CloudForms System Engine are advised to upgrade to these updated
packages.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "CloudForms System Engine 1.1.2 is now available.\n\nThe Red Hat Security Response Team has rated this update as having moderate\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat CloudForms is an on-premise hybrid cloud\nInfrastructure-as-a-Service (IaaS) product that lets you create and manage\nprivate and public clouds. It provides self-service computing resources to\nusers in a managed, governed, and secure way. CloudForms System Engine can\nbe used to configure new systems, subscribe to updates, and maintain\ninstallations in distributed environments.\n\nIt was found that the\n\"/usr/share/katello/script/katello-generate-passphrase\" utility, which is\nrun during the installation and configuration process, set world-readable\npermissions on the \"/etc/katello/secure/passphrase\" file. A local attacker\ncould use this flaw to obtain the passphrase for Katello, giving them\naccess to information they would otherwise not have access to.\n(CVE-2012-5561)\n\nNote: After installing this update, ensure the\n\"/etc/katello/secure/passphrase\" file is owned by the root user and group\nand mode 0750 permissions. Sites should also consider re-creating the\nKatello passphrase as this issue exposed it to local users.\n\nOne task the katello-configure utility performs is creating an RPM to be\ninstalled on client machines that need to connect to the Katello server. It\nwas found that this RPM set world-readable and writable permissions on the\npem file (containing the Certificate Authority certificate) used for\ntrusting the Katello server. An attacker could use this flaw to perform a\nman-in-the-middle attack, allowing them to manage (such as installing and\nremoving software) Katello client systems. (CVE-2012-6116)\n\nThe CVE-2012-5561 issue was discovered by Aaron Weitekamp of the Red Hat\nCloud Quality Engineering team, and CVE-2012-6116 was discovered by Dominic\nCleal and James Laska of Red Hat.\n\nThis update also fixes the following bugs:\n\n* The CloudForms System Engine command line tool incorrectly parsed\nlocales, which caused the following error:\n\n\"translation missing: de.activerecord.errors.messages.record_invalid\"\n\nThis update replaces the controller for setting the locale. The translation\nerror no longer appears. (BZ#896251)\n\n* Certain locales did not properly escape certain UI content for new role\ncreation. This broke the Save button for some locales. This update corrects\nthe escape behavior for localized UI content. The Save button now works\nfor new role creation. (BZ#896252)\n\n* A missing icon stopped users from deleting recent or saved searches. This\nupdate adds the icon and users can now delete recent or saved searches.\n(BZ#896253)\n\n* A performance issue in the Candlepin 0.7.8 component caused subscription\nresponsiveness to decrease as the number of systems subscribed to\nCloudForms System Engine increases. This erratum updates to Candlepin\n0.7.19, which corrects the performance issues. (BZ#896261)\n\n* CloudForms System Engine would not fetch Extended Update Service (EUS)\nentitlements. This blocked the user from seeing and enabling EUS\nrepositories. This update revises the manifest upload and deletion code,\nwhich also corrects the behavior for fetching entitlements. System Engine\nnow fetches EUS entitlements. (BZ#896265)\n\n* Issues with menu widths caused the localized UI to not render certain\nmenu items. This update corrects the style for the System Engine UI. The\nWeb UI now renders the menu items correctly. (BZ#903702)\n\nRefer to the CloudForms 1.1.2 Release Notes for further information about\nthis release. The Release Notes will be available shortly from\nhttps://access.redhat.com/knowledge/docs/\n\nTo upgrade, follow the upgrade instructions in the CloudForms Installation\nGuide, section \"4.1. Upgrading CloudForms System Engine\":\n\nhttps://access.redhat.com/knowledge/docs/en-US/CloudForms/1.1/html/Installation_Guide/index.html\n\nUsers of CloudForms System Engine are advised to upgrade to these updated\npackages.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2013:0547", "url": "https://access.redhat.com/errata/RHSA-2013:0547" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "https://access.redhat.com/knowledge/docs/", "url": "https://access.redhat.com/knowledge/docs/" }, { "category": "external", "summary": "https://access.redhat.com/knowledge/docs/en-US/CloudForms/1.1/html/Installation_Guide/index.html", "url": "https://access.redhat.com/knowledge/docs/en-US/CloudForms/1.1/html/Installation_Guide/index.html" }, { "category": "external", "summary": "807455", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=807455" }, { "category": "external", "summary": "879094", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=879094" }, { "category": "external", "summary": "896251", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=896251" }, { "category": "external", "summary": "896253", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=896253" }, { "category": "external", "summary": "896261", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=896261" }, { "category": "external", "summary": "896265", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=896265" }, { "category": "external", "summary": "903702", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=903702" }, { "category": "external", "summary": "904128", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=904128" }, { "category": "external", "summary": "906207", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=906207" }, { "category": "external", "summary": "907250", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=907250" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0547.json" } ], "title": "Red Hat Security Advisory: CloudForms System Engine 1.1.2 update", "tracking": { "current_release_date": "2024-11-05T18:00:48+00:00", "generator": { "date": "2024-11-05T18:00:48+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2013:0547", "initial_release_date": "2013-02-21T18:55:00+00:00", "revision_history": [ { "date": "2013-02-21T18:55:00+00:00", "number": "1", "summary": "Initial version" }, { "date": "2013-02-21T19:01:10+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-05T18:00:48+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "CloudForms System Engine for RHEL 6 Server", "product": { "name": "CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine", "product_identification_helper": { "cpe": "cpe:/a:cloudforms_systemengine:1::el6" } } } ], "category": "product_family", "name": "Red Hat CloudForms" }, { "branches": [ { "category": "product_version", "name": "katello-configure-0:1.1.9-13.el6cf.noarch", "product": { "name": "katello-configure-0:1.1.9-13.el6cf.noarch", "product_id": "katello-configure-0:1.1.9-13.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/katello-configure@1.1.9-13.el6cf?arch=noarch" } } }, { "category": "product_version", "name": "katello-cli-0:1.1.8-14.el6cf.noarch", "product": { "name": "katello-cli-0:1.1.8-14.el6cf.noarch", "product_id": "katello-cli-0:1.1.8-14.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/katello-cli@1.1.8-14.el6cf?arch=noarch" } } }, { "category": "product_version", "name": "katello-cli-common-0:1.1.8-14.el6cf.noarch", "product": { "name": "katello-cli-common-0:1.1.8-14.el6cf.noarch", "product_id": "katello-cli-common-0:1.1.8-14.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/katello-cli-common@1.1.8-14.el6cf?arch=noarch" } } }, { "category": "product_version", "name": "candlepin-devel-0:0.7.19-3.el6cf.noarch", "product": { "name": "candlepin-devel-0:0.7.19-3.el6cf.noarch", "product_id": "candlepin-devel-0:0.7.19-3.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/candlepin-devel@0.7.19-3.el6cf?arch=noarch" } } }, { "category": "product_version", "name": "candlepin-tomcat6-0:0.7.19-3.el6cf.noarch", "product": { "name": "candlepin-tomcat6-0:0.7.19-3.el6cf.noarch", "product_id": "candlepin-tomcat6-0:0.7.19-3.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/candlepin-tomcat6@0.7.19-3.el6cf?arch=noarch" } } }, { "category": "product_version", "name": "candlepin-0:0.7.19-3.el6cf.noarch", "product": { "name": "candlepin-0:0.7.19-3.el6cf.noarch", "product_id": "candlepin-0:0.7.19-3.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/candlepin@0.7.19-3.el6cf?arch=noarch" } } }, { "category": "product_version", "name": "candlepin-selinux-0:0.7.19-3.el6cf.noarch", "product": { "name": "candlepin-selinux-0:0.7.19-3.el6cf.noarch", "product_id": "candlepin-selinux-0:0.7.19-3.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/candlepin-selinux@0.7.19-3.el6cf?arch=noarch" } } }, { "category": "product_version", "name": "katello-selinux-0:1.1.1-5.el6cf.noarch", "product": { "name": "katello-selinux-0:1.1.1-5.el6cf.noarch", "product_id": "katello-selinux-0:1.1.1-5.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/katello-selinux@1.1.1-5.el6cf?arch=noarch" } } }, { "category": "product_version", "name": "katello-0:1.1.12.2-5.el6cf.noarch", "product": { "name": "katello-0:1.1.12.2-5.el6cf.noarch", "product_id": "katello-0:1.1.12.2-5.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/katello@1.1.12.2-5.el6cf?arch=noarch" } } }, { "category": "product_version", "name": "katello-api-docs-0:1.1.12.2-5.el6cf.noarch", "product": { "name": "katello-api-docs-0:1.1.12.2-5.el6cf.noarch", "product_id": "katello-api-docs-0:1.1.12.2-5.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/katello-api-docs@1.1.12.2-5.el6cf?arch=noarch" } } }, { "category": "product_version", "name": "katello-common-0:1.1.12.2-5.el6cf.noarch", "product": { "name": "katello-common-0:1.1.12.2-5.el6cf.noarch", "product_id": "katello-common-0:1.1.12.2-5.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/katello-common@1.1.12.2-5.el6cf?arch=noarch" } } }, { "category": "product_version", "name": "katello-glue-candlepin-0:1.1.12.2-5.el6cf.noarch", "product": { "name": "katello-glue-candlepin-0:1.1.12.2-5.el6cf.noarch", "product_id": "katello-glue-candlepin-0:1.1.12.2-5.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/katello-glue-candlepin@1.1.12.2-5.el6cf?arch=noarch" } } }, { "category": "product_version", "name": "katello-glue-pulp-0:1.1.12.2-5.el6cf.noarch", "product": { "name": "katello-glue-pulp-0:1.1.12.2-5.el6cf.noarch", "product_id": "katello-glue-pulp-0:1.1.12.2-5.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/katello-glue-pulp@1.1.12.2-5.el6cf?arch=noarch" } } }, { "category": "product_version", "name": "katello-all-0:1.1.12.2-5.el6cf.noarch", "product": { "name": "katello-all-0:1.1.12.2-5.el6cf.noarch", "product_id": "katello-all-0:1.1.12.2-5.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/katello-all@1.1.12.2-5.el6cf?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "katello-configure-0:1.1.9-13.el6cf.src", "product": { "name": "katello-configure-0:1.1.9-13.el6cf.src", "product_id": "katello-configure-0:1.1.9-13.el6cf.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/katello-configure@1.1.9-13.el6cf?arch=src" } } }, { "category": "product_version", "name": "katello-cli-0:1.1.8-14.el6cf.src", "product": { "name": "katello-cli-0:1.1.8-14.el6cf.src", "product_id": "katello-cli-0:1.1.8-14.el6cf.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/katello-cli@1.1.8-14.el6cf?arch=src" } } }, { "category": "product_version", "name": "candlepin-0:0.7.19-3.el6cf.src", "product": { "name": "candlepin-0:0.7.19-3.el6cf.src", "product_id": "candlepin-0:0.7.19-3.el6cf.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/candlepin@0.7.19-3.el6cf?arch=src" } } }, { "category": "product_version", "name": "katello-selinux-0:1.1.1-5.el6cf.src", "product": { "name": "katello-selinux-0:1.1.1-5.el6cf.src", "product_id": "katello-selinux-0:1.1.1-5.el6cf.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/katello-selinux@1.1.1-5.el6cf?arch=src" } } }, { "category": "product_version", "name": "katello-0:1.1.12.2-5.el6cf.src", "product": { "name": "katello-0:1.1.12.2-5.el6cf.src", "product_id": "katello-0:1.1.12.2-5.el6cf.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/katello@1.1.12.2-5.el6cf?arch=src" } } } ], "category": "architecture", "name": "src" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "candlepin-0:0.7.19-3.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:candlepin-0:0.7.19-3.el6cf.noarch" }, "product_reference": "candlepin-0:0.7.19-3.el6cf.noarch", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "candlepin-0:0.7.19-3.el6cf.src as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:candlepin-0:0.7.19-3.el6cf.src" }, "product_reference": "candlepin-0:0.7.19-3.el6cf.src", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "candlepin-devel-0:0.7.19-3.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:candlepin-devel-0:0.7.19-3.el6cf.noarch" }, "product_reference": "candlepin-devel-0:0.7.19-3.el6cf.noarch", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "candlepin-selinux-0:0.7.19-3.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:candlepin-selinux-0:0.7.19-3.el6cf.noarch" }, "product_reference": "candlepin-selinux-0:0.7.19-3.el6cf.noarch", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "candlepin-tomcat6-0:0.7.19-3.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:candlepin-tomcat6-0:0.7.19-3.el6cf.noarch" }, "product_reference": "candlepin-tomcat6-0:0.7.19-3.el6cf.noarch", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "katello-0:1.1.12.2-5.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:katello-0:1.1.12.2-5.el6cf.noarch" }, "product_reference": "katello-0:1.1.12.2-5.el6cf.noarch", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "katello-0:1.1.12.2-5.el6cf.src as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:katello-0:1.1.12.2-5.el6cf.src" }, "product_reference": "katello-0:1.1.12.2-5.el6cf.src", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "katello-all-0:1.1.12.2-5.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:katello-all-0:1.1.12.2-5.el6cf.noarch" }, "product_reference": "katello-all-0:1.1.12.2-5.el6cf.noarch", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "katello-api-docs-0:1.1.12.2-5.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:katello-api-docs-0:1.1.12.2-5.el6cf.noarch" }, "product_reference": "katello-api-docs-0:1.1.12.2-5.el6cf.noarch", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "katello-cli-0:1.1.8-14.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:katello-cli-0:1.1.8-14.el6cf.noarch" }, "product_reference": "katello-cli-0:1.1.8-14.el6cf.noarch", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "katello-cli-0:1.1.8-14.el6cf.src as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:katello-cli-0:1.1.8-14.el6cf.src" }, "product_reference": "katello-cli-0:1.1.8-14.el6cf.src", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "katello-cli-common-0:1.1.8-14.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:katello-cli-common-0:1.1.8-14.el6cf.noarch" }, "product_reference": "katello-cli-common-0:1.1.8-14.el6cf.noarch", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "katello-common-0:1.1.12.2-5.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:katello-common-0:1.1.12.2-5.el6cf.noarch" }, "product_reference": "katello-common-0:1.1.12.2-5.el6cf.noarch", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "katello-configure-0:1.1.9-13.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:katello-configure-0:1.1.9-13.el6cf.noarch" }, "product_reference": "katello-configure-0:1.1.9-13.el6cf.noarch", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "katello-configure-0:1.1.9-13.el6cf.src as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:katello-configure-0:1.1.9-13.el6cf.src" }, "product_reference": "katello-configure-0:1.1.9-13.el6cf.src", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "katello-glue-candlepin-0:1.1.12.2-5.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:katello-glue-candlepin-0:1.1.12.2-5.el6cf.noarch" }, "product_reference": "katello-glue-candlepin-0:1.1.12.2-5.el6cf.noarch", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "katello-glue-pulp-0:1.1.12.2-5.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:katello-glue-pulp-0:1.1.12.2-5.el6cf.noarch" }, "product_reference": "katello-glue-pulp-0:1.1.12.2-5.el6cf.noarch", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "katello-selinux-0:1.1.1-5.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:katello-selinux-0:1.1.1-5.el6cf.noarch" }, "product_reference": "katello-selinux-0:1.1.1-5.el6cf.noarch", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "katello-selinux-0:1.1.1-5.el6cf.src as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:katello-selinux-0:1.1.1-5.el6cf.src" }, "product_reference": "katello-selinux-0:1.1.1-5.el6cf.src", "relates_to_product_reference": "6Server-SystemEngine" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "Aaron Weitekamp" ], "organization": "Red Hat Cloud Quality Engineering team", "summary": "This issue was discovered by Red Hat." } ], "cve": "CVE-2012-5561", "discovery_date": "2012-11-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "879094" } ], "notes": [ { "category": "description", "text": "script/katello-generate-passphrase in Katello 1.1 uses world-readable permissions for /etc/katello/secure/passphrase, which allows local users to obtain the passphrase by reading the file.", "title": "Vulnerability description" }, { "category": "summary", "text": "Katello: /etc/katello/secure/passphrase is world readable", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-SystemEngine:candlepin-0:0.7.19-3.el6cf.noarch", "6Server-SystemEngine:candlepin-0:0.7.19-3.el6cf.src", "6Server-SystemEngine:candlepin-devel-0:0.7.19-3.el6cf.noarch", "6Server-SystemEngine:candlepin-selinux-0:0.7.19-3.el6cf.noarch", "6Server-SystemEngine:candlepin-tomcat6-0:0.7.19-3.el6cf.noarch", "6Server-SystemEngine:katello-0:1.1.12.2-5.el6cf.noarch", "6Server-SystemEngine:katello-0:1.1.12.2-5.el6cf.src", "6Server-SystemEngine:katello-all-0:1.1.12.2-5.el6cf.noarch", "6Server-SystemEngine:katello-api-docs-0:1.1.12.2-5.el6cf.noarch", "6Server-SystemEngine:katello-cli-0:1.1.8-14.el6cf.noarch", "6Server-SystemEngine:katello-cli-0:1.1.8-14.el6cf.src", "6Server-SystemEngine:katello-cli-common-0:1.1.8-14.el6cf.noarch", "6Server-SystemEngine:katello-common-0:1.1.12.2-5.el6cf.noarch", "6Server-SystemEngine:katello-configure-0:1.1.9-13.el6cf.noarch", "6Server-SystemEngine:katello-configure-0:1.1.9-13.el6cf.src", "6Server-SystemEngine:katello-glue-candlepin-0:1.1.12.2-5.el6cf.noarch", "6Server-SystemEngine:katello-glue-pulp-0:1.1.12.2-5.el6cf.noarch", "6Server-SystemEngine:katello-selinux-0:1.1.1-5.el6cf.noarch", "6Server-SystemEngine:katello-selinux-0:1.1.1-5.el6cf.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2012-5561" }, { "category": "external", "summary": "RHBZ#879094", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=879094" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2012-5561", "url": "https://www.cve.org/CVERecord?id=CVE-2012-5561" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-5561", "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-5561" } ], "release_date": "2013-01-03T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2013-02-21T18:55:00+00:00", "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258", "product_ids": [ "6Server-SystemEngine:candlepin-0:0.7.19-3.el6cf.noarch", "6Server-SystemEngine:candlepin-0:0.7.19-3.el6cf.src", "6Server-SystemEngine:candlepin-devel-0:0.7.19-3.el6cf.noarch", "6Server-SystemEngine:candlepin-selinux-0:0.7.19-3.el6cf.noarch", "6Server-SystemEngine:candlepin-tomcat6-0:0.7.19-3.el6cf.noarch", "6Server-SystemEngine:katello-0:1.1.12.2-5.el6cf.noarch", "6Server-SystemEngine:katello-0:1.1.12.2-5.el6cf.src", "6Server-SystemEngine:katello-all-0:1.1.12.2-5.el6cf.noarch", "6Server-SystemEngine:katello-api-docs-0:1.1.12.2-5.el6cf.noarch", "6Server-SystemEngine:katello-cli-0:1.1.8-14.el6cf.noarch", "6Server-SystemEngine:katello-cli-0:1.1.8-14.el6cf.src", "6Server-SystemEngine:katello-cli-common-0:1.1.8-14.el6cf.noarch", "6Server-SystemEngine:katello-common-0:1.1.12.2-5.el6cf.noarch", "6Server-SystemEngine:katello-configure-0:1.1.9-13.el6cf.noarch", "6Server-SystemEngine:katello-configure-0:1.1.9-13.el6cf.src", "6Server-SystemEngine:katello-glue-candlepin-0:1.1.12.2-5.el6cf.noarch", "6Server-SystemEngine:katello-glue-pulp-0:1.1.12.2-5.el6cf.noarch", "6Server-SystemEngine:katello-selinux-0:1.1.1-5.el6cf.noarch", "6Server-SystemEngine:katello-selinux-0:1.1.1-5.el6cf.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2013:0547" } ], "scores": [ { "cvss_v2": { "accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.1, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0" }, "products": [ "6Server-SystemEngine:candlepin-0:0.7.19-3.el6cf.noarch", "6Server-SystemEngine:candlepin-0:0.7.19-3.el6cf.src", "6Server-SystemEngine:candlepin-devel-0:0.7.19-3.el6cf.noarch", "6Server-SystemEngine:candlepin-selinux-0:0.7.19-3.el6cf.noarch", "6Server-SystemEngine:candlepin-tomcat6-0:0.7.19-3.el6cf.noarch", "6Server-SystemEngine:katello-0:1.1.12.2-5.el6cf.noarch", "6Server-SystemEngine:katello-0:1.1.12.2-5.el6cf.src", "6Server-SystemEngine:katello-all-0:1.1.12.2-5.el6cf.noarch", "6Server-SystemEngine:katello-api-docs-0:1.1.12.2-5.el6cf.noarch", "6Server-SystemEngine:katello-cli-0:1.1.8-14.el6cf.noarch", "6Server-SystemEngine:katello-cli-0:1.1.8-14.el6cf.src", "6Server-SystemEngine:katello-cli-common-0:1.1.8-14.el6cf.noarch", "6Server-SystemEngine:katello-common-0:1.1.12.2-5.el6cf.noarch", "6Server-SystemEngine:katello-configure-0:1.1.9-13.el6cf.noarch", "6Server-SystemEngine:katello-configure-0:1.1.9-13.el6cf.src", "6Server-SystemEngine:katello-glue-candlepin-0:1.1.12.2-5.el6cf.noarch", "6Server-SystemEngine:katello-glue-pulp-0:1.1.12.2-5.el6cf.noarch", "6Server-SystemEngine:katello-selinux-0:1.1.1-5.el6cf.noarch", "6Server-SystemEngine:katello-selinux-0:1.1.1-5.el6cf.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Katello: /etc/katello/secure/passphrase is world readable" }, { "acknowledgments": [ { "names": [ "Dominic Cleal" ] }, { "names": [ "James Laska" ], "organization": "Red Hat", "summary": "This issue was discovered by Red Hat." } ], "cve": "CVE-2012-6116", "discovery_date": "2012-11-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "906207" } ], "notes": [ { "category": "description", "text": "modules/certs/manifests/config.pp in katello-configure before 1.3.3.pulpv2 in Katello uses weak permissions (666) for the Candlepin bootstrap RPM, which allows local users to modify the Candlepin CA certificate by writing to this file.", "title": "Vulnerability description" }, { "category": "summary", "text": "Candlepin: bootstrap RPM deploys CA certificate file with mode 666", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-SystemEngine:candlepin-0:0.7.19-3.el6cf.noarch", "6Server-SystemEngine:candlepin-0:0.7.19-3.el6cf.src", "6Server-SystemEngine:candlepin-devel-0:0.7.19-3.el6cf.noarch", "6Server-SystemEngine:candlepin-selinux-0:0.7.19-3.el6cf.noarch", "6Server-SystemEngine:candlepin-tomcat6-0:0.7.19-3.el6cf.noarch", "6Server-SystemEngine:katello-0:1.1.12.2-5.el6cf.noarch", "6Server-SystemEngine:katello-0:1.1.12.2-5.el6cf.src", "6Server-SystemEngine:katello-all-0:1.1.12.2-5.el6cf.noarch", "6Server-SystemEngine:katello-api-docs-0:1.1.12.2-5.el6cf.noarch", "6Server-SystemEngine:katello-cli-0:1.1.8-14.el6cf.noarch", "6Server-SystemEngine:katello-cli-0:1.1.8-14.el6cf.src", "6Server-SystemEngine:katello-cli-common-0:1.1.8-14.el6cf.noarch", "6Server-SystemEngine:katello-common-0:1.1.12.2-5.el6cf.noarch", "6Server-SystemEngine:katello-configure-0:1.1.9-13.el6cf.noarch", "6Server-SystemEngine:katello-configure-0:1.1.9-13.el6cf.src", "6Server-SystemEngine:katello-glue-candlepin-0:1.1.12.2-5.el6cf.noarch", "6Server-SystemEngine:katello-glue-pulp-0:1.1.12.2-5.el6cf.noarch", "6Server-SystemEngine:katello-selinux-0:1.1.1-5.el6cf.noarch", "6Server-SystemEngine:katello-selinux-0:1.1.1-5.el6cf.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2012-6116" }, { "category": "external", "summary": "RHBZ#906207", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=906207" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2012-6116", "url": "https://www.cve.org/CVERecord?id=CVE-2012-6116" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-6116", "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6116" } ], "release_date": "2013-02-21T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2013-02-21T18:55:00+00:00", "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258", "product_ids": [ "6Server-SystemEngine:candlepin-0:0.7.19-3.el6cf.noarch", "6Server-SystemEngine:candlepin-0:0.7.19-3.el6cf.src", "6Server-SystemEngine:candlepin-devel-0:0.7.19-3.el6cf.noarch", "6Server-SystemEngine:candlepin-selinux-0:0.7.19-3.el6cf.noarch", "6Server-SystemEngine:candlepin-tomcat6-0:0.7.19-3.el6cf.noarch", "6Server-SystemEngine:katello-0:1.1.12.2-5.el6cf.noarch", "6Server-SystemEngine:katello-0:1.1.12.2-5.el6cf.src", "6Server-SystemEngine:katello-all-0:1.1.12.2-5.el6cf.noarch", "6Server-SystemEngine:katello-api-docs-0:1.1.12.2-5.el6cf.noarch", "6Server-SystemEngine:katello-cli-0:1.1.8-14.el6cf.noarch", "6Server-SystemEngine:katello-cli-0:1.1.8-14.el6cf.src", "6Server-SystemEngine:katello-cli-common-0:1.1.8-14.el6cf.noarch", "6Server-SystemEngine:katello-common-0:1.1.12.2-5.el6cf.noarch", "6Server-SystemEngine:katello-configure-0:1.1.9-13.el6cf.noarch", "6Server-SystemEngine:katello-configure-0:1.1.9-13.el6cf.src", "6Server-SystemEngine:katello-glue-candlepin-0:1.1.12.2-5.el6cf.noarch", "6Server-SystemEngine:katello-glue-pulp-0:1.1.12.2-5.el6cf.noarch", "6Server-SystemEngine:katello-selinux-0:1.1.1-5.el6cf.noarch", "6Server-SystemEngine:katello-selinux-0:1.1.1-5.el6cf.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2013:0547" } ], "scores": [ { "cvss_v2": { "accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0" }, "products": [ "6Server-SystemEngine:candlepin-0:0.7.19-3.el6cf.noarch", "6Server-SystemEngine:candlepin-0:0.7.19-3.el6cf.src", "6Server-SystemEngine:candlepin-devel-0:0.7.19-3.el6cf.noarch", "6Server-SystemEngine:candlepin-selinux-0:0.7.19-3.el6cf.noarch", "6Server-SystemEngine:candlepin-tomcat6-0:0.7.19-3.el6cf.noarch", "6Server-SystemEngine:katello-0:1.1.12.2-5.el6cf.noarch", "6Server-SystemEngine:katello-0:1.1.12.2-5.el6cf.src", "6Server-SystemEngine:katello-all-0:1.1.12.2-5.el6cf.noarch", "6Server-SystemEngine:katello-api-docs-0:1.1.12.2-5.el6cf.noarch", "6Server-SystemEngine:katello-cli-0:1.1.8-14.el6cf.noarch", "6Server-SystemEngine:katello-cli-0:1.1.8-14.el6cf.src", "6Server-SystemEngine:katello-cli-common-0:1.1.8-14.el6cf.noarch", "6Server-SystemEngine:katello-common-0:1.1.12.2-5.el6cf.noarch", "6Server-SystemEngine:katello-configure-0:1.1.9-13.el6cf.noarch", "6Server-SystemEngine:katello-configure-0:1.1.9-13.el6cf.src", "6Server-SystemEngine:katello-glue-candlepin-0:1.1.12.2-5.el6cf.noarch", "6Server-SystemEngine:katello-glue-pulp-0:1.1.12.2-5.el6cf.noarch", "6Server-SystemEngine:katello-selinux-0:1.1.1-5.el6cf.noarch", "6Server-SystemEngine:katello-selinux-0:1.1.1-5.el6cf.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Candlepin: bootstrap RPM deploys CA certificate file with mode 666" } ] }
ghsa-h3g7-crqm-323f
Vulnerability from github
Published
2022-05-17 05:12
Modified
2022-05-17 05:12
Details
modules/certs/manifests/config.pp in katello-configure before 1.3.3.pulpv2 in Katello uses weak permissions (666) for the Candlepin bootstrap RPM, which allows local users to modify the Candlepin CA certificate by writing to this file.
{ "affected": [], "aliases": [ "CVE-2012-6116" ], "database_specific": { "cwe_ids": [], "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2013-03-01T05:40:00Z", "severity": "LOW" }, "details": "modules/certs/manifests/config.pp in katello-configure before 1.3.3.pulpv2 in Katello uses weak permissions (666) for the Candlepin bootstrap RPM, which allows local users to modify the Candlepin CA certificate by writing to this file.", "id": "GHSA-h3g7-crqm-323f", "modified": "2022-05-17T05:12:23Z", "published": "2022-05-17T05:12:23Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6116" }, { "type": "WEB", "url": "https://github.com/jsomara/katello/commit/65f1e42b7bda0f3410931c50598540d944d8bf0d" }, { "type": "WEB", "url": "https://github.com/Katello/katello/commits/master/katello-configure/katello-configure.spec" }, { "type": "WEB", "url": "http://rhn.redhat.com/errata/RHSA-2013-0547.html" }, { "type": "WEB", "url": "http://rhn.redhat.com/errata/RHSA-2013-0686.html" }, { "type": "WEB", "url": "http://secunia.com/advisories/52774" } ], "schema_version": "1.4.0", "severity": [] }
gsd-2012-6116
Vulnerability from gsd
Modified
2023-12-13 01:20
Details
modules/certs/manifests/config.pp in katello-configure before 1.3.3.pulpv2 in Katello uses weak permissions (666) for the Candlepin bootstrap RPM, which allows local users to modify the Candlepin CA certificate by writing to this file.
Aliases
Aliases
{ "GSD": { "alias": "CVE-2012-6116", "description": "modules/certs/manifests/config.pp in katello-configure before 1.3.3.pulpv2 in Katello uses weak permissions (666) for the Candlepin bootstrap RPM, which allows local users to modify the Candlepin CA certificate by writing to this file.", "id": "GSD-2012-6116", "references": [ "https://access.redhat.com/errata/RHSA-2013:0686", "https://access.redhat.com/errata/RHSA-2013:0547" ] }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2012-6116" ], "details": "modules/certs/manifests/config.pp in katello-configure before 1.3.3.pulpv2 in Katello uses weak permissions (666) for the Candlepin bootstrap RPM, which allows local users to modify the Candlepin CA certificate by writing to this file.", "id": "GSD-2012-6116", "modified": "2023-12-13T01:20:17.312632Z", "schema_version": "1.4.0" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "ASSIGNER": "secalert@redhat.com", "ID": "CVE-2012-6116", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_affected": "=", "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "modules/certs/manifests/config.pp in katello-configure before 1.3.3.pulpv2 in Katello uses weak permissions (666) for the Candlepin bootstrap RPM, which allows local users to modify the Candlepin CA certificate by writing to this file." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "http://rhn.redhat.com/errata/RHSA-2013-0547.html", "refsource": "MISC", "url": "http://rhn.redhat.com/errata/RHSA-2013-0547.html" }, { "name": "http://rhn.redhat.com/errata/RHSA-2013-0686.html", "refsource": "MISC", "url": "http://rhn.redhat.com/errata/RHSA-2013-0686.html" }, { "name": "http://secunia.com/advisories/52774", "refsource": "MISC", "url": "http://secunia.com/advisories/52774" }, { "name": "https://github.com/Katello/katello/commits/master/katello-configure/katello-configure.spec", "refsource": "MISC", "url": "https://github.com/Katello/katello/commits/master/katello-configure/katello-configure.spec" }, { "name": "https://github.com/jsomara/katello/commit/65f1e42b7bda0f3410931c50598540d944d8bf0d", "refsource": "MISC", "url": "https://github.com/jsomara/katello/commit/65f1e42b7bda0f3410931c50598540d944d8bf0d" } ] } }, "nvd.nist.gov": { "configurations": { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:katello:katello:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:katello:katello-configure:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "1.3.2_pulpv2", "vulnerable": true } ], "operator": "OR" } ] }, "cve": { "CVE_data_meta": { "ASSIGNER": "secalert@redhat.com", "ID": "CVE-2012-6116" }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "en", "value": "modules/certs/manifests/config.pp in katello-configure before 1.3.3.pulpv2 in Katello uses weak permissions (666) for the Candlepin bootstrap RPM, which allows local users to modify the Candlepin CA certificate by writing to this file." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "en", "value": "CWE-264" } ] } ] }, "references": { "reference_data": [ { "name": "RHSA-2013:0547", "refsource": "REDHAT", "tags": [], "url": "http://rhn.redhat.com/errata/RHSA-2013-0547.html" }, { "name": "https://github.com/jsomara/katello/commit/65f1e42b7bda0f3410931c50598540d944d8bf0d", "refsource": "CONFIRM", "tags": [], "url": "https://github.com/jsomara/katello/commit/65f1e42b7bda0f3410931c50598540d944d8bf0d" }, { "name": "https://github.com/Katello/katello/commits/master/katello-configure/katello-configure.spec", "refsource": "CONFIRM", "tags": [], "url": "https://github.com/Katello/katello/commits/master/katello-configure/katello-configure.spec" }, { "name": "52774", "refsource": "SECUNIA", "tags": [], "url": "http://secunia.com/advisories/52774" }, { "name": "RHSA-2013:0686", "refsource": "REDHAT", "tags": [], "url": "http://rhn.redhat.com/errata/RHSA-2013-0686.html" } ] } }, "impact": { "baseMetricV2": { "cvssV2": { "accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.1, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0" }, "exploitabilityScore": 3.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "LOW", "userInteractionRequired": false } }, "lastModifiedDate": "2013-04-04T03:21Z", "publishedDate": "2013-03-01T05:40Z" } } }
Loading...
Loading...
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.