CVE-2012-6119: Low severity candlepin vulnerability
Candlepin before 0.7.24, as used in Red Hat Subscription Asset Manager before 1.2.1, does not properly check manifest signatures, which allows local users to modify manifests.
Other sources
Description of problem:
User can muck with a manifest file, upload it and it will still parse (in most reasonable cases, I imagine).
Version-Release number of selected component (if applicable):
How reproducible:
Steps to Reproduce: 1. Get a manifest file. drill down into $manifest.zip > consumerexport.zip export > entitlements 2. Modify the id value in the first line of the contained file. If you want, go ahead and rename the file to match the id string you just modified. 3. Attempt to import manifest file into CFSE Actual results: Manifest file is imported.
Expected results: Manifest file should be rejected due to lack of signature integrity.
Additional info:
Apparently a known backlog issue in candlepin - tracked here to assure visibility in QE.
Does this exist in the wild? If so, what's to stop a customer from staying on any existing CFSE install and hacking away at a manifest to their heart's content? I know such changes used to get rejected. Not sure how recent a development this is.
External reference: https://github.com/candlepin/candlepin/commit/f4d93230e58b969c506b4c9778e04482a059b08c
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-6119?
CVE-2012-6119 is classified as a medium severity vulnerability due to its potential to allow local users to modify manifest files.
How do I fix CVE-2012-6119?
To fix CVE-2012-6119, upgrade Candlepin to version 0.7.24 or later and Red Hat Subscription Asset Manager to version 1.2.1 or later.
What versions are affected by CVE-2012-6119?
CVE-2012-6119 affects Candlepin versions prior to 0.7.24 and Red Hat Subscription Asset Manager versions up to 1.2.0, including specific earlier versions.
What are the risks associated with CVE-2012-6119?
The risks include unauthorized modification of manifest files, which could lead to inconsistencies or breaches in subscription management.
Who is impacted by CVE-2012-6119?
Users of vulnerable versions of Candlepin and Red Hat Subscription Asset Manager are directly impacted by CVE-2012-6119.