CVE-2012-6116: Low severity katello vulnerability
modules/certs/manifests/config.pp in katello-configure before 1.3.3.pulpv2 in Katello uses weak permissions (666) for the Candlepin bootstrap RPM, which allows local users to modify the Candlepin CA certificate by writing to this file.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-6116?
CVE-2012-6116 has been rated as a moderate severity vulnerability due to the potential for local users to alter sensitive certificate files.
How do I fix CVE-2012-6116?
To fix CVE-2012-6116, update the Katello software to version 1.3.3.pulpv2 or later to ensure proper permissions are set on the Candlepin bootstrap RPM.
What kind of vulnerability is CVE-2012-6116?
CVE-2012-6116 is a permissions vulnerability that allows local users to modify important files due to incorrectly set file permissions.
What is the impact of CVE-2012-6116?
The impact of CVE-2012-6116 includes the risk of local users being able to alter the Candlepin CA certificate, potentially compromising certificate integrity.
Is CVE-2012-6116 specific to certain versions of Katello?
Yes, CVE-2012-6116 specifically affects versions of Katello earlier than 1.3.3.pulpv2.