{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cP\u003eVersions ant\u00e9rieures \u00e0 OS X Mountain Lion 10.8.4\u003c/P\u003e",
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2013-0982",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0982"
    },
    {
      "name": "CVE-2012-0050",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-0050"
    },
    {
      "name": "CVE-2013-0984",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0984"
    },
    {
      "name": "CVE-2013-0277",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0277"
    },
    {
      "name": "CVE-2013-1856",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-1856"
    },
    {
      "name": "CVE-2011-3210",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-3210"
    },
    {
      "name": "CVE-2013-1855",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-1855"
    },
    {
      "name": "CVE-2013-0276",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0276"
    },
    {
      "name": "CVE-2011-4619",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-4619"
    },
    {
      "name": "CVE-2013-0985",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0985"
    },
    {
      "name": "CVE-2012-2110",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-2110"
    },
    {
      "name": "CVE-2011-4576",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-4576"
    },
    {
      "name": "CVE-2011-4577",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-4577"
    },
    {
      "name": "CVE-2013-0983",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0983"
    },
    {
      "name": "CVE-2013-0989",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0989"
    },
    {
      "name": "CVE-2011-4108",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-4108"
    },
    {
      "name": "CVE-2013-0990",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0990"
    },
    {
      "name": "CVE-2013-0155",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0155"
    },
    {
      "name": "CVE-2013-0986",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0986"
    },
    {
      "name": "CVE-2013-0988",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0988"
    },
    {
      "name": "CVE-2013-1024",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-1024"
    },
    {
      "name": "CVE-2013-0975",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0975"
    },
    {
      "name": "CVE-2011-4109",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-4109"
    },
    {
      "name": "CVE-2011-3207",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-3207"
    },
    {
      "name": "CVE-2012-5519",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-5519"
    },
    {
      "name": "CVE-2011-1945",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-1945"
    },
    {
      "name": "CVE-2013-0987",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0987"
    },
    {
      "name": "CVE-2012-4929",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-4929"
    },
    {
      "name": "CVE-2013-1854",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-1854"
    },
    {
      "name": "CVE-2013-0333",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0333"
    },
    {
      "name": "CVE-2012-2333",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-2333"
    },
    {
      "name": "CVE-2013-1857",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-1857"
    },
    {
      "name": "CVE-2012-2131",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-2131"
    }
  ],
  "links": [],
  "reference": "CERTA-2013-AVI-340",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2013-06-05T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eApple OS X\u003c/span\u003e. Elles permettent \u00e0 un attaquant de\nprovoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un contournement\nde la politique de s\u00e9curit\u00e9 et une atteinte \u00e0 la confidentialit\u00e9 des\ndonn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Apple OS X",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apple HT5784 du 04 juin 2013",
      "url": "http://support.apple.com/kb/HT5784"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cP\u003eVersions ant\u00e9rieures \u00e0 OS X Mountain Lion 10.8.4\u003c/P\u003e",
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2013-0982",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0982"
    },
    {
      "name": "CVE-2012-0050",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-0050"
    },
    {
      "name": "CVE-2013-0984",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0984"
    },
    {
      "name": "CVE-2013-0277",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0277"
    },
    {
      "name": "CVE-2013-1856",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-1856"
    },
    {
      "name": "CVE-2011-3210",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-3210"
    },
    {
      "name": "CVE-2013-1855",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-1855"
    },
    {
      "name": "CVE-2013-0276",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0276"
    },
    {
      "name": "CVE-2011-4619",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-4619"
    },
    {
      "name": "CVE-2013-0985",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0985"
    },
    {
      "name": "CVE-2012-2110",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-2110"
    },
    {
      "name": "CVE-2011-4576",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-4576"
    },
    {
      "name": "CVE-2011-4577",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-4577"
    },
    {
      "name": "CVE-2013-0983",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0983"
    },
    {
      "name": "CVE-2013-0989",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0989"
    },
    {
      "name": "CVE-2011-4108",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-4108"
    },
    {
      "name": "CVE-2013-0990",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0990"
    },
    {
      "name": "CVE-2013-0155",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0155"
    },
    {
      "name": "CVE-2013-0986",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0986"
    },
    {
      "name": "CVE-2013-0988",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0988"
    },
    {
      "name": "CVE-2013-1024",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-1024"
    },
    {
      "name": "CVE-2013-0975",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0975"
    },
    {
      "name": "CVE-2011-4109",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-4109"
    },
    {
      "name": "CVE-2011-3207",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-3207"
    },
    {
      "name": "CVE-2012-5519",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-5519"
    },
    {
      "name": "CVE-2011-1945",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-1945"
    },
    {
      "name": "CVE-2013-0987",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0987"
    },
    {
      "name": "CVE-2012-4929",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-4929"
    },
    {
      "name": "CVE-2013-1854",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-1854"
    },
    {
      "name": "CVE-2013-0333",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0333"
    },
    {
      "name": "CVE-2012-2333",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-2333"
    },
    {
      "name": "CVE-2013-1857",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-1857"
    },
    {
      "name": "CVE-2012-2131",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-2131"
    }
  ],
  "links": [],
  "reference": "CERTA-2013-AVI-340",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2013-06-05T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eApple OS X\u003c/span\u003e. Elles permettent \u00e0 un attaquant de\nprovoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un contournement\nde la politique de s\u00e9curit\u00e9 et une atteinte \u00e0 la confidentialit\u00e9 des\ndonn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Apple OS X",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apple HT5784 du 04 juin 2013",
      "url": "http://support.apple.com/kb/HT5784"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Ruby on Rails versions ant\u00e9rieures \u00e0 2.3.17",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "Ruby on Rails versions ant\u00e9rieures \u00e0 3.1.11",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "Ruby on Rails versions ant\u00e9rieures \u00e0 3.2.12",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2013-0277",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0277"
    },
    {
      "name": "CVE-2013-0276",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0276"
    },
    {
      "name": "CVE-2013-0269",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0269"
    }
  ],
  "links": [],
  "reference": "CERTA-2013-AVI-133",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2013-02-15T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eRuby on Rails\u003c/span\u003e . Elles permettent \u00e0 un attaquant de\nprovoquer une ex\u00e9cution de code arbitraire \u00e0 distance et un\ncontournement de la politique de s\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Ruby on Rails",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby on Rails du 11 f\u00e9vrier 2013",
      "url": "http://weblog.rubyonrails.org/2013/2/11/SEC-ANN-Rails-3-2-12-3-1-11-and-2-3-17-have-been-released/"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Ruby on Rails versions ant\u00e9rieures \u00e0 2.3.17",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "Ruby on Rails versions ant\u00e9rieures \u00e0 3.1.11",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "Ruby on Rails versions ant\u00e9rieures \u00e0 3.2.12",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2013-0277",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0277"
    },
    {
      "name": "CVE-2013-0276",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0276"
    },
    {
      "name": "CVE-2013-0269",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0269"
    }
  ],
  "links": [],
  "reference": "CERTA-2013-AVI-133",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2013-02-15T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eRuby on Rails\u003c/span\u003e . Elles permettent \u00e0 un attaquant de\nprovoquer une ex\u00e9cution de code arbitraire \u00e0 distance et un\ncontournement de la politique de s\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Ruby on Rails",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby on Rails du 11 f\u00e9vrier 2013",
      "url": "http://weblog.rubyonrails.org/2013/2/11/SEC-ANN-Rails-3-2-12-3-1-11-and-2-3-17-have-been-released/"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat Subscription Asset Manager 1.2.1, which fixes several security\nissues, multiple bugs, and adds various enhancements, is now available.\n\nThe Red Hat Security Response Team has rated this update as having moderate\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Subscription Asset Manager acts as a proxy for handling\nsubscription information and software updates on client machines.\n\nThe latest packages for Subscription Asset Manager include a number of security fixes:\n\nWhen a Subscription Asset Manager instance is created, its configuration\nscript automatically creates an RPM of the internal subscription service \nCA certificate. However, this RPM incorrectly created the CA certificate\nwith file permissions of 0666. This allowed other users on a client system\nto modify the CA certificate used to trust the remote subscription server.\nAll administrators are advised to update and deploy the subscription\nservice certificate on all systems which use Subscription Asset Manager\nas their subscription service. This procedure is described in:\nhttps://access.redhat.com/knowledge/docs/en-US/Red_Hat_Subscription_Asset_Manager/1.2/html/Installation_Guide/sect-Installation_Guide-Administration-Upgrading_Subscription_Asset_Manager.html\n(CVE-2012-6116)\n\nManifest signature checking was not implemented for early versions of \nSubscription Asset Manager. This meant that a malicious user could edit\na manifest file, insert arbitrary data, and successfully upload the edited\nmanifest file into the Subscription Asset Manager server. (CVE-2012-6119)\n\nRuby\u0027s documentation generator had a flaw in the way it generated HTML\ndocumentation. When a Ruby application exposed its documentation\non a network (such as a web page), an attacker could use a specially-\ncrafted URL to open an arbitrary web script or to execute HTML code\nwithin the application\u0027s user session. (CVE-2013-0256)\n\nA timing attack flaw was found in the way rubygem-rack and\nruby193-rubygem-rack processed HMAC digests in cookies. This flaw could aid\nan attacker using forged digital signatures to bypass authentication\nchecks. (CVE-2013-0263)\n\nA flaw in rubygem-json allowed remote attacks by creating different types\nof malicious objects. For example, it could initiate a denial of service\n(DoS) attack through resource consumption by using a JSON document to\ncreate arbitrary Ruby symbols, which were never garbage collected. It\ncould also be exploited to create internal objects which could allow a SQL\ninjection attack. (CVE-2013-0269)\n\nA flaw in ActiveRecord in Ruby on Rails allowed remote attackers to\ncircumvent attribute protections and to insert their own crafted requests\nto change protected attribute values. (CVE-2013-0276)\n\nHTML markup was not properly escaped when filling in the username field in\nthe Notifications form of the Subscription Asset Manager UI. This meant\nthat HTML code used in the value was then applied in the UI page when the\nentry was viewed. This could have allowed malicious HTML code to be\nentered. The field value is now validated and any HTML tags are escaped.\n(CVE-2013-1823)\n\nThese updated packages also include bug fixes and enhancements:\n\n* Previously, no SELinux policy for the subscription service was included\nwith the Subscription Asset Manager packages. The candlepin-selinux package\nis now included with SELinux policies for the subscription server. \n(BZ#906901)\n\n* When attempting to use the subscription service\u0027s CA certificate to\nvalidate a manifest during import, the comparison failed. The upstream\nsubscription service which generated the manifest is a different service\nthan the local subscription service; thus, they have different CA\ncertificates. This caused importing a manifest to fail with the error\n\u0027archive failed signature\u0027. This has been fixed so that the proper\ncertificate is used for verification. (BZ#918778)\n\nAll users of Subscription Asset Manager are recommended to update to the\nlatest packages.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2013:0686",
        "url": "https://access.redhat.com/errata/RHSA-2013:0686"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "906207",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=906207"
      },
      {
        "category": "external",
        "summary": "906901",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=906901"
      },
      {
        "category": "external",
        "summary": "907820",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=907820"
      },
      {
        "category": "external",
        "summary": "908613",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=908613"
      },
      {
        "category": "external",
        "summary": "909029",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=909029"
      },
      {
        "category": "external",
        "summary": "909071",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=909071"
      },
      {
        "category": "external",
        "summary": "909528",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=909528"
      },
      {
        "category": "external",
        "summary": "918778",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=918778"
      },
      {
        "category": "external",
        "summary": "918784",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=918784"
      },
      {
        "category": "external",
        "summary": "922190",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=922190"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0686.json"
      }
    ],
    "title": "Red Hat Security Advisory: Subscription Asset Manager 1.2.1 update",
    "tracking": {
      "current_release_date": "2024-11-22T06:54:39+00:00",
      "generator": {
        "date": "2024-11-22T06:54:39+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2013:0686",
      "initial_release_date": "2013-03-26T19:10:00+00:00",
      "revision_history": [
        {
          "date": "2013-03-26T19:10:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2013-03-26T19:16:44+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-22T06:54:39+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Subscription Asset Manager for RHEL 6 Server",
                "product": {
                  "name": "Red Hat Subscription Asset Manager for RHEL 6 Server",
                  "product_id": "6Server-SubscriptionAssetManager12",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:rhel_sam:1.2::el6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Subscription Asset Manager"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch",
                "product": {
                  "name": "rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch",
                  "product_id": "rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rubygem-rails_warden-doc@0.5.5-2.el6cf?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rubygem-rails_warden-0:0.5.5-2.el6cf.noarch",
                "product": {
                  "name": "rubygem-rails_warden-0:0.5.5-2.el6cf.noarch",
                  "product_id": "rubygem-rails_warden-0:0.5.5-2.el6cf.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rubygem-rails_warden@0.5.5-2.el6cf?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rubygem-delayed_job-0:2.1.4-3.el6cf.noarch",
                "product": {
                  "name": "rubygem-delayed_job-0:2.1.4-3.el6cf.noarch",
                  "product_id": "rubygem-delayed_job-0:2.1.4-3.el6cf.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rubygem-delayed_job@2.1.4-3.el6cf?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch",
                "product": {
                  "name": "rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch",
                  "product_id": "rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rubygem-delayed_job-doc@2.1.4-3.el6cf?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch",
                "product": {
                  "name": "rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch",
                  "product_id": "rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rubygem-nokogiri-doc@1.5.0-0.9.beta4.el6cf?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rubygem-actionpack-1:3.0.10-12.el6cf.noarch",
                "product": {
                  "name": "rubygem-actionpack-1:3.0.10-12.el6cf.noarch",
                  "product_id": "rubygem-actionpack-1:3.0.10-12.el6cf.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rubygem-actionpack@3.0.10-12.el6cf?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "candlepin-0:0.7.24-1.el6_3.noarch",
                "product": {
                  "name": "candlepin-0:0.7.24-1.el6_3.noarch",
                  "product_id": "candlepin-0:0.7.24-1.el6_3.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/candlepin@0.7.24-1.el6_3?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "candlepin-tomcat6-0:0.7.24-1.el6_3.noarch",
                "product": {
                  "name": "candlepin-tomcat6-0:0.7.24-1.el6_3.noarch",
                  "product_id": "candlepin-tomcat6-0:0.7.24-1.el6_3.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/candlepin-tomcat6@0.7.24-1.el6_3?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "candlepin-selinux-0:0.7.24-1.el6_3.noarch",
                "product": {
                  "name": "candlepin-selinux-0:0.7.24-1.el6_3.noarch",
                  "product_id": "candlepin-selinux-0:0.7.24-1.el6_3.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/candlepin-selinux@0.7.24-1.el6_3?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "candlepin-devel-0:0.7.24-1.el6_3.noarch",
                "product": {
                  "name": "candlepin-devel-0:0.7.24-1.el6_3.noarch",
                  "product_id": "candlepin-devel-0:0.7.24-1.el6_3.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/candlepin-devel@0.7.24-1.el6_3?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rubygem-rack-1:1.3.0-4.el6cf.noarch",
                "product": {
                  "name": "rubygem-rack-1:1.3.0-4.el6cf.noarch",
                  "product_id": "rubygem-rack-1:1.3.0-4.el6cf.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rubygem-rack@1.3.0-4.el6cf?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch",
                "product": {
                  "name": "rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch",
                  "product_id": "rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rubygem-activemodel-doc@3.0.10-3.el6cf?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rubygem-activemodel-0:3.0.10-3.el6cf.noarch",
                "product": {
                  "name": "rubygem-activemodel-0:3.0.10-3.el6cf.noarch",
                  "product_id": "rubygem-activemodel-0:3.0.10-3.el6cf.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rubygem-activemodel@3.0.10-3.el6cf?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rubygem-rdoc-doc-0:3.8-6.el6cf.noarch",
                "product": {
                  "name": "rubygem-rdoc-doc-0:3.8-6.el6cf.noarch",
                  "product_id": "rubygem-rdoc-doc-0:3.8-6.el6cf.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rubygem-rdoc-doc@3.8-6.el6cf?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rubygem-rdoc-0:3.8-6.el6cf.noarch",
                "product": {
                  "name": "rubygem-rdoc-0:3.8-6.el6cf.noarch",
                  "product_id": "rubygem-rdoc-0:3.8-6.el6cf.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rubygem-rdoc@3.8-6.el6cf?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "katello-headpin-0:1.2.1.1-1h.el6_4.noarch",
                "product": {
                  "name": "katello-headpin-0:1.2.1.1-1h.el6_4.noarch",
                  "product_id": "katello-headpin-0:1.2.1.1-1h.el6_4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/katello-headpin@1.2.1.1-1h.el6_4?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch",
                "product": {
                  "name": "katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch",
                  "product_id": "katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/katello-glue-candlepin@1.2.1.1-1h.el6_4?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "katello-common-0:1.2.1.1-1h.el6_4.noarch",
                "product": {
                  "name": "katello-common-0:1.2.1.1-1h.el6_4.noarch",
                  "product_id": "katello-common-0:1.2.1.1-1h.el6_4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/katello-common@1.2.1.1-1h.el6_4?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch",
                "product": {
                  "name": "katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch",
                  "product_id": "katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/katello-headpin-all@1.2.1.1-1h.el6_4?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "thumbslug-0:0.0.28.1-1.el6_4.noarch",
                "product": {
                  "name": "thumbslug-0:0.0.28.1-1.el6_4.noarch",
                  "product_id": "thumbslug-0:0.0.28.1-1.el6_4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/thumbslug@0.0.28.1-1.el6_4?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch",
                "product": {
                  "name": "thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch",
                  "product_id": "thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/thumbslug-selinux@0.0.28.1-1.el6_4?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "katello-configure-0:1.2.3.1-4h.el6_4.noarch",
                "product": {
                  "name": "katello-configure-0:1.2.3.1-4h.el6_4.noarch",
                  "product_id": "katello-configure-0:1.2.3.1-4h.el6_4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/katello-configure@1.2.3.1-4h.el6_4?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rubygem-rails_warden-0:0.5.5-2.el6cf.src",
                "product": {
                  "name": "rubygem-rails_warden-0:0.5.5-2.el6cf.src",
                  "product_id": "rubygem-rails_warden-0:0.5.5-2.el6cf.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rubygem-rails_warden@0.5.5-2.el6cf?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rubygem-delayed_job-0:2.1.4-3.el6cf.src",
                "product": {
                  "name": "rubygem-delayed_job-0:2.1.4-3.el6cf.src",
                  "product_id": "rubygem-delayed_job-0:2.1.4-3.el6cf.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rubygem-delayed_job@2.1.4-3.el6cf?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src",
                "product": {
                  "name": "rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src",
                  "product_id": "rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rubygem-nokogiri@1.5.0-0.9.beta4.el6cf?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rubygem-actionpack-1:3.0.10-12.el6cf.src",
                "product": {
                  "name": "rubygem-actionpack-1:3.0.10-12.el6cf.src",
                  "product_id": "rubygem-actionpack-1:3.0.10-12.el6cf.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rubygem-actionpack@3.0.10-12.el6cf?arch=src\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "candlepin-0:0.7.24-1.el6_3.src",
                "product": {
                  "name": "candlepin-0:0.7.24-1.el6_3.src",
                  "product_id": "candlepin-0:0.7.24-1.el6_3.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/candlepin@0.7.24-1.el6_3?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rubygem-rack-1:1.3.0-4.el6cf.src",
                "product": {
                  "name": "rubygem-rack-1:1.3.0-4.el6cf.src",
                  "product_id": "rubygem-rack-1:1.3.0-4.el6cf.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rubygem-rack@1.3.0-4.el6cf?arch=src\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rubygem-activemodel-0:3.0.10-3.el6cf.src",
                "product": {
                  "name": "rubygem-activemodel-0:3.0.10-3.el6cf.src",
                  "product_id": "rubygem-activemodel-0:3.0.10-3.el6cf.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rubygem-activemodel@3.0.10-3.el6cf?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rubygem-rdoc-0:3.8-6.el6cf.src",
                "product": {
                  "name": "rubygem-rdoc-0:3.8-6.el6cf.src",
                  "product_id": "rubygem-rdoc-0:3.8-6.el6cf.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rubygem-rdoc@3.8-6.el6cf?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "katello-0:1.2.1.1-1h.el6_4.src",
                "product": {
                  "name": "katello-0:1.2.1.1-1h.el6_4.src",
                  "product_id": "katello-0:1.2.1.1-1h.el6_4.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/katello@1.2.1.1-1h.el6_4?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rubygem-json-0:1.7.3-2.el6_3.src",
                "product": {
                  "name": "rubygem-json-0:1.7.3-2.el6_3.src",
                  "product_id": "rubygem-json-0:1.7.3-2.el6_3.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rubygem-json@1.7.3-2.el6_3?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "thumbslug-0:0.0.28.1-1.el6_4.src",
                "product": {
                  "name": "thumbslug-0:0.0.28.1-1.el6_4.src",
                  "product_id": "thumbslug-0:0.0.28.1-1.el6_4.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/thumbslug@0.0.28.1-1.el6_4?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "katello-configure-0:1.2.3.1-4h.el6_4.src",
                "product": {
                  "name": "katello-configure-0:1.2.3.1-4h.el6_4.src",
                  "product_id": "katello-configure-0:1.2.3.1-4h.el6_4.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/katello-configure@1.2.3.1-4h.el6_4?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64",
                "product": {
                  "name": "rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64",
                  "product_id": "rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rubygem-nokogiri-debuginfo@1.5.0-0.9.beta4.el6cf?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
                "product": {
                  "name": "rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
                  "product_id": "rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rubygem-nokogiri@1.5.0-0.9.beta4.el6cf?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
                "product": {
                  "name": "ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
                  "product_id": "ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ruby-nokogiri@1.5.0-0.9.beta4.el6cf?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64",
                "product": {
                  "name": "rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64",
                  "product_id": "rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rubygem-json-debuginfo@1.7.3-2.el6_3?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rubygem-json-0:1.7.3-2.el6_3.x86_64",
                "product": {
                  "name": "rubygem-json-0:1.7.3-2.el6_3.x86_64",
                  "product_id": "rubygem-json-0:1.7.3-2.el6_3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rubygem-json@1.7.3-2.el6_3?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "candlepin-0:0.7.24-1.el6_3.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
          "product_id": "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch"
        },
        "product_reference": "candlepin-0:0.7.24-1.el6_3.noarch",
        "relates_to_product_reference": "6Server-SubscriptionAssetManager12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "candlepin-0:0.7.24-1.el6_3.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
          "product_id": "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src"
        },
        "product_reference": "candlepin-0:0.7.24-1.el6_3.src",
        "relates_to_product_reference": "6Server-SubscriptionAssetManager12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "candlepin-devel-0:0.7.24-1.el6_3.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
          "product_id": "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch"
        },
        "product_reference": "candlepin-devel-0:0.7.24-1.el6_3.noarch",
        "relates_to_product_reference": "6Server-SubscriptionAssetManager12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "candlepin-selinux-0:0.7.24-1.el6_3.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
          "product_id": "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch"
        },
        "product_reference": "candlepin-selinux-0:0.7.24-1.el6_3.noarch",
        "relates_to_product_reference": "6Server-SubscriptionAssetManager12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "candlepin-tomcat6-0:0.7.24-1.el6_3.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
          "product_id": "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch"
        },
        "product_reference": "candlepin-tomcat6-0:0.7.24-1.el6_3.noarch",
        "relates_to_product_reference": "6Server-SubscriptionAssetManager12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "katello-0:1.2.1.1-1h.el6_4.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
          "product_id": "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src"
        },
        "product_reference": "katello-0:1.2.1.1-1h.el6_4.src",
        "relates_to_product_reference": "6Server-SubscriptionAssetManager12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "katello-common-0:1.2.1.1-1h.el6_4.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
          "product_id": "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch"
        },
        "product_reference": "katello-common-0:1.2.1.1-1h.el6_4.noarch",
        "relates_to_product_reference": "6Server-SubscriptionAssetManager12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "katello-configure-0:1.2.3.1-4h.el6_4.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
          "product_id": "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch"
        },
        "product_reference": "katello-configure-0:1.2.3.1-4h.el6_4.noarch",
        "relates_to_product_reference": "6Server-SubscriptionAssetManager12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "katello-configure-0:1.2.3.1-4h.el6_4.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
          "product_id": "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src"
        },
        "product_reference": "katello-configure-0:1.2.3.1-4h.el6_4.src",
        "relates_to_product_reference": "6Server-SubscriptionAssetManager12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
          "product_id": "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch"
        },
        "product_reference": "katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch",
        "relates_to_product_reference": "6Server-SubscriptionAssetManager12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "katello-headpin-0:1.2.1.1-1h.el6_4.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
          "product_id": "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch"
        },
        "product_reference": "katello-headpin-0:1.2.1.1-1h.el6_4.noarch",
        "relates_to_product_reference": "6Server-SubscriptionAssetManager12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
          "product_id": "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch"
        },
        "product_reference": "katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch",
        "relates_to_product_reference": "6Server-SubscriptionAssetManager12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64 as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
          "product_id": "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64"
        },
        "product_reference": "ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
        "relates_to_product_reference": "6Server-SubscriptionAssetManager12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-actionpack-1:3.0.10-12.el6cf.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
          "product_id": "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch"
        },
        "product_reference": "rubygem-actionpack-1:3.0.10-12.el6cf.noarch",
        "relates_to_product_reference": "6Server-SubscriptionAssetManager12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-actionpack-1:3.0.10-12.el6cf.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
          "product_id": "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src"
        },
        "product_reference": "rubygem-actionpack-1:3.0.10-12.el6cf.src",
        "relates_to_product_reference": "6Server-SubscriptionAssetManager12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-activemodel-0:3.0.10-3.el6cf.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
          "product_id": "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch"
        },
        "product_reference": "rubygem-activemodel-0:3.0.10-3.el6cf.noarch",
        "relates_to_product_reference": "6Server-SubscriptionAssetManager12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-activemodel-0:3.0.10-3.el6cf.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
          "product_id": "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src"
        },
        "product_reference": "rubygem-activemodel-0:3.0.10-3.el6cf.src",
        "relates_to_product_reference": "6Server-SubscriptionAssetManager12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
          "product_id": "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch"
        },
        "product_reference": "rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch",
        "relates_to_product_reference": "6Server-SubscriptionAssetManager12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-delayed_job-0:2.1.4-3.el6cf.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
          "product_id": "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch"
        },
        "product_reference": "rubygem-delayed_job-0:2.1.4-3.el6cf.noarch",
        "relates_to_product_reference": "6Server-SubscriptionAssetManager12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-delayed_job-0:2.1.4-3.el6cf.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
          "product_id": "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src"
        },
        "product_reference": "rubygem-delayed_job-0:2.1.4-3.el6cf.src",
        "relates_to_product_reference": "6Server-SubscriptionAssetManager12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
          "product_id": "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch"
        },
        "product_reference": "rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch",
        "relates_to_product_reference": "6Server-SubscriptionAssetManager12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-json-0:1.7.3-2.el6_3.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
          "product_id": "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src"
        },
        "product_reference": "rubygem-json-0:1.7.3-2.el6_3.src",
        "relates_to_product_reference": "6Server-SubscriptionAssetManager12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-json-0:1.7.3-2.el6_3.x86_64 as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
          "product_id": "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64"
        },
        "product_reference": "rubygem-json-0:1.7.3-2.el6_3.x86_64",
        "relates_to_product_reference": "6Server-SubscriptionAssetManager12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64 as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
          "product_id": "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64"
        },
        "product_reference": "rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64",
        "relates_to_product_reference": "6Server-SubscriptionAssetManager12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
          "product_id": "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src"
        },
        "product_reference": "rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src",
        "relates_to_product_reference": "6Server-SubscriptionAssetManager12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64 as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
          "product_id": "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64"
        },
        "product_reference": "rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
        "relates_to_product_reference": "6Server-SubscriptionAssetManager12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64 as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
          "product_id": "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64"
        },
        "product_reference": "rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64",
        "relates_to_product_reference": "6Server-SubscriptionAssetManager12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
          "product_id": "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch"
        },
        "product_reference": "rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch",
        "relates_to_product_reference": "6Server-SubscriptionAssetManager12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-rack-1:1.3.0-4.el6cf.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
          "product_id": "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch"
        },
        "product_reference": "rubygem-rack-1:1.3.0-4.el6cf.noarch",
        "relates_to_product_reference": "6Server-SubscriptionAssetManager12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-rack-1:1.3.0-4.el6cf.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
          "product_id": "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src"
        },
        "product_reference": "rubygem-rack-1:1.3.0-4.el6cf.src",
        "relates_to_product_reference": "6Server-SubscriptionAssetManager12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-rails_warden-0:0.5.5-2.el6cf.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
          "product_id": "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch"
        },
        "product_reference": "rubygem-rails_warden-0:0.5.5-2.el6cf.noarch",
        "relates_to_product_reference": "6Server-SubscriptionAssetManager12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-rails_warden-0:0.5.5-2.el6cf.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
          "product_id": "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src"
        },
        "product_reference": "rubygem-rails_warden-0:0.5.5-2.el6cf.src",
        "relates_to_product_reference": "6Server-SubscriptionAssetManager12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
          "product_id": "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch"
        },
        "product_reference": "rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch",
        "relates_to_product_reference": "6Server-SubscriptionAssetManager12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-rdoc-0:3.8-6.el6cf.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
          "product_id": "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch"
        },
        "product_reference": "rubygem-rdoc-0:3.8-6.el6cf.noarch",
        "relates_to_product_reference": "6Server-SubscriptionAssetManager12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-rdoc-0:3.8-6.el6cf.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
          "product_id": "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src"
        },
        "product_reference": "rubygem-rdoc-0:3.8-6.el6cf.src",
        "relates_to_product_reference": "6Server-SubscriptionAssetManager12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-rdoc-doc-0:3.8-6.el6cf.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
          "product_id": "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch"
        },
        "product_reference": "rubygem-rdoc-doc-0:3.8-6.el6cf.noarch",
        "relates_to_product_reference": "6Server-SubscriptionAssetManager12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "thumbslug-0:0.0.28.1-1.el6_4.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
          "product_id": "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch"
        },
        "product_reference": "thumbslug-0:0.0.28.1-1.el6_4.noarch",
        "relates_to_product_reference": "6Server-SubscriptionAssetManager12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "thumbslug-0:0.0.28.1-1.el6_4.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
          "product_id": "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src"
        },
        "product_reference": "thumbslug-0:0.0.28.1-1.el6_4.src",
        "relates_to_product_reference": "6Server-SubscriptionAssetManager12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
          "product_id": "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch"
        },
        "product_reference": "thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch",
        "relates_to_product_reference": "6Server-SubscriptionAssetManager12"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Dominic Cleal"
          ]
        },
        {
          "names": [
            "James Laska"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2012-6116",
      "discovery_date": "2012-11-16T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "906207"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "modules/certs/manifests/config.pp in katello-configure before 1.3.3.pulpv2 in Katello uses weak permissions (666) for the Candlepin bootstrap RPM, which allows local users to modify the Candlepin CA certificate by writing to this file.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Candlepin: bootstrap RPM deploys CA certificate file with mode 666",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch",
          "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src",
          "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch",
          "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch",
          "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch",
          "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src",
          "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch",
          "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch",
          "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src",
          "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch",
          "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch",
          "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch",
          "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
          "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src",
          "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src",
          "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src",
          "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src",
          "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64",
          "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64",
          "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src",
          "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
          "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64",
          "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src",
          "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src",
          "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src",
          "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch",
          "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src",
          "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2012-6116"
        },
        {
          "category": "external",
          "summary": "RHBZ#906207",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=906207"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2012-6116",
          "url": "https://www.cve.org/CVERecord?id=CVE-2012-6116"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-6116",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6116"
        }
      ],
      "release_date": "2013-02-21T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2013-03-26T19:10:00+00:00",
          "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
          "product_ids": [
            "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch",
            "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src",
            "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch",
            "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch",
            "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch",
            "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src",
            "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src",
            "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src",
            "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src",
            "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2013:0686"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.6,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch",
            "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src",
            "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch",
            "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch",
            "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch",
            "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src",
            "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src",
            "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src",
            "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src",
            "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Candlepin: bootstrap RPM deploys CA certificate file with mode 666"
    },
    {
      "cve": "CVE-2012-6119",
      "discovery_date": "2013-02-01T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "908613"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Candlepin before 0.7.24, as used in Red Hat Subscription Asset Manager before 1.2.1, does not properly check manifest signatures, which allows local users to modify manifests.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Candlepin: Re-enable manifest signature checking",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch",
          "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src",
          "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch",
          "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch",
          "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch",
          "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src",
          "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch",
          "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch",
          "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src",
          "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch",
          "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch",
          "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch",
          "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
          "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src",
          "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src",
          "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src",
          "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src",
          "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64",
          "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64",
          "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src",
          "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
          "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64",
          "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src",
          "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src",
          "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src",
          "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch",
          "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src",
          "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2012-6119"
        },
        {
          "category": "external",
          "summary": "RHBZ#908613",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=908613"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2012-6119",
          "url": "https://www.cve.org/CVERecord?id=CVE-2012-6119"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-6119",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6119"
        }
      ],
      "release_date": "2012-06-27T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2013-03-26T19:10:00+00:00",
          "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
          "product_ids": [
            "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch",
            "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src",
            "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch",
            "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch",
            "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch",
            "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src",
            "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src",
            "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src",
            "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src",
            "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2013:0686"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "NONE",
            "baseScore": 4.0,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch",
            "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src",
            "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch",
            "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch",
            "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch",
            "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src",
            "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src",
            "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src",
            "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src",
            "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Candlepin: Re-enable manifest signature checking"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Eric Hodel"
          ],
          "organization": "RDoc upstream"
        },
        {
          "names": [
            "Evgeny Ermakov"
          ],
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2013-0256",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2013-02-05T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "907820"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rubygem-rdoc: Cross-site scripting in the documentation created by Darkfish Rdoc HTML generator / template",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch",
          "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src",
          "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch",
          "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch",
          "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch",
          "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src",
          "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch",
          "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch",
          "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src",
          "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch",
          "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch",
          "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch",
          "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
          "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src",
          "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src",
          "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src",
          "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src",
          "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64",
          "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64",
          "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src",
          "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
          "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64",
          "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src",
          "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src",
          "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src",
          "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch",
          "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src",
          "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-0256"
        },
        {
          "category": "external",
          "summary": "RHBZ#907820",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=907820"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-0256",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-0256"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-0256",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0256"
        },
        {
          "category": "external",
          "summary": "http://www.ruby-lang.org/en/news/2013/02/06/rdoc-xss-cve-2013-0256/",
          "url": "http://www.ruby-lang.org/en/news/2013/02/06/rdoc-xss-cve-2013-0256/"
        }
      ],
      "release_date": "2013-02-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2013-03-26T19:10:00+00:00",
          "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
          "product_ids": [
            "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch",
            "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src",
            "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch",
            "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch",
            "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch",
            "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src",
            "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src",
            "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src",
            "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src",
            "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2013:0686"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch",
            "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src",
            "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch",
            "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch",
            "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch",
            "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src",
            "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src",
            "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src",
            "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src",
            "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "rubygem-rdoc: Cross-site scripting in the documentation created by Darkfish Rdoc HTML generator / template"
    },
    {
      "cve": "CVE-2013-0263",
      "discovery_date": "2013-02-08T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "909071"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rubygem-rack: Timing attack in cookie sessions",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch",
          "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src",
          "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch",
          "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch",
          "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch",
          "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src",
          "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch",
          "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch",
          "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src",
          "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch",
          "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch",
          "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch",
          "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
          "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src",
          "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src",
          "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src",
          "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src",
          "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64",
          "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64",
          "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src",
          "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
          "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64",
          "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src",
          "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src",
          "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src",
          "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch",
          "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src",
          "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-0263"
        },
        {
          "category": "external",
          "summary": "RHBZ#909071",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=909071"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-0263",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-0263"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-0263",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0263"
        }
      ],
      "release_date": "2013-02-08T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2013-03-26T19:10:00+00:00",
          "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
          "product_ids": [
            "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch",
            "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src",
            "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch",
            "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch",
            "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch",
            "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src",
            "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src",
            "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src",
            "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src",
            "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2013:0686"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch",
            "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src",
            "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch",
            "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch",
            "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch",
            "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src",
            "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src",
            "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src",
            "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src",
            "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "rubygem-rack: Timing attack in cookie sessions"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Ruby on Rails upstream"
          ]
        },
        {
          "names": [
            "Thomas Hollstegge"
          ],
          "organization": "Zweitag",
          "summary": "Acknowledged by upstream."
        },
        {
          "names": [
            "Ben Murphy"
          ],
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2013-0269",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2013-02-07T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "909029"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka \"Unsafe Object Creation Vulnerability.\"",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rubygem-json: Denial of Service and SQL Injection",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Satellite tools ship RubyGem Json 1.4.6 which is earlier than affected 1.5.5 version however, this version of RubyGem is not affected to the flaw. We may update RubyGem in a future release.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch",
          "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src",
          "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch",
          "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch",
          "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch",
          "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src",
          "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch",
          "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch",
          "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src",
          "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch",
          "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch",
          "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch",
          "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
          "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src",
          "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src",
          "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src",
          "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src",
          "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64",
          "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64",
          "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src",
          "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
          "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64",
          "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src",
          "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src",
          "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src",
          "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch",
          "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src",
          "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-0269"
        },
        {
          "category": "external",
          "summary": "RHBZ#909029",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=909029"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-0269",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-0269"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-0269",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0269"
        },
        {
          "category": "external",
          "summary": "http://www.ruby-lang.org/en/news/2013/02/22/json-dos-cve-2013-0269/",
          "url": "http://www.ruby-lang.org/en/news/2013/02/22/json-dos-cve-2013-0269/"
        }
      ],
      "release_date": "2013-02-11T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2013-03-26T19:10:00+00:00",
          "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
          "product_ids": [
            "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch",
            "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src",
            "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch",
            "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch",
            "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch",
            "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src",
            "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src",
            "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src",
            "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src",
            "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2013:0686"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch",
            "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src",
            "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch",
            "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch",
            "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch",
            "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src",
            "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src",
            "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src",
            "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src",
            "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "rubygem-json: Denial of Service and SQL Injection"
    },
    {
      "cve": "CVE-2013-0276",
      "discovery_date": "2013-02-08T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "909528"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "ActiveRecord in Ruby on Rails before 2.3.17, 3.1.x before 3.1.11, and 3.2.x before 3.2.12 allows remote attackers to bypass the attr_protected protection mechanism and modify protected model attributes via a crafted request.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rubygem-activerecord/rubygem-activemodel: circumvention of attr_protected",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch",
          "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src",
          "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch",
          "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch",
          "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch",
          "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src",
          "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch",
          "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch",
          "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src",
          "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch",
          "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch",
          "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch",
          "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
          "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src",
          "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src",
          "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src",
          "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src",
          "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64",
          "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64",
          "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src",
          "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
          "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64",
          "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src",
          "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src",
          "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src",
          "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch",
          "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src",
          "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-0276"
        },
        {
          "category": "external",
          "summary": "RHBZ#909528",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=909528"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-0276",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-0276"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-0276",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0276"
        }
      ],
      "release_date": "2013-02-11T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2013-03-26T19:10:00+00:00",
          "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
          "product_ids": [
            "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch",
            "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src",
            "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch",
            "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch",
            "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch",
            "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src",
            "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src",
            "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src",
            "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src",
            "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2013:0686"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch",
            "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src",
            "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch",
            "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch",
            "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch",
            "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src",
            "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src",
            "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src",
            "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src",
            "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "rubygem-activerecord/rubygem-activemodel: circumvention of attr_protected"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Sureshkumar Thirugnanasambandan"
          ],
          "organization": "Red Hat Quality Engineering Team",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2013-1823",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2013-02-12T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "918784"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Cross-site scripting (XSS) vulnerability in the Notifications form in Red Hat Subscription Asset Manager before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the username field.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Katello: Notifications page Username XSS",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch",
          "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src",
          "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch",
          "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch",
          "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch",
          "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src",
          "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch",
          "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch",
          "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src",
          "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch",
          "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch",
          "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch",
          "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
          "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src",
          "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src",
          "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src",
          "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src",
          "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64",
          "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64",
          "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src",
          "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
          "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64",
          "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src",
          "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src",
          "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src",
          "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch",
          "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch",
          "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src",
          "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-1823"
        },
        {
          "category": "external",
          "summary": "RHBZ#918784",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=918784"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-1823",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-1823"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-1823",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1823"
        }
      ],
      "release_date": "2013-03-26T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2013-03-26T19:10:00+00:00",
          "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
          "product_ids": [
            "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch",
            "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src",
            "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch",
            "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch",
            "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch",
            "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src",
            "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src",
            "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src",
            "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src",
            "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2013:0686"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch",
            "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src",
            "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch",
            "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch",
            "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch",
            "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src",
            "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src",
            "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src",
            "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64",
            "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src",
            "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch",
            "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch",
            "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src",
            "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "Katello: Notifications page Username XSS"
    }
  ]
}