CVE-2013-4455: Low severity Katello Katello Installer vulnerability
Dominic Cleal reports:
/etc/pki/tls/private/katello-node.key is created in the apache::certs class in node-installer when a child Pulp node is deployed.
It contains the private key for the node, that's normally kept in files with 0600 permissions.
Other sources
Katello Installer before 0.0.18 uses world-readable permissions for /etc/pki/tls/private/katello-node.key when deploying a child Pulp node, which allows local users to obtain the private key by reading the file.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4455?
CVE-2013-4455 has a medium severity due to the exposure of sensitive private keys.
How do I fix CVE-2013-4455?
To fix CVE-2013-4455, upgrade to Katello Installer version 0.0.18 or later.
Which versions of Katello Installer are affected by CVE-2013-4455?
CVE-2013-4455 affects all Katello Installer versions before 0.0.18.
What risks are associated with CVE-2013-4455?
The main risk associated with CVE-2013-4455 is the potential exposure of private keys, which could lead to unauthorized access.
How is the private key in CVE-2013-4455 improperly secured?
In CVE-2013-4455, the private key is created with world-readable permissions instead of the secure 0600 permissions.