CVE-2015-5187: Infoleak
Candlepin allows remote attackers to obtain sensitive information by obtaining Java exception statements as a result of excessive web traffic.
Other sources
John Sefler of Red Hat reports:
Under heavy load Candlepin may experience timeouts resulting in Java exception errors that can contain sensitive information. This only affects sites using candlepin with extremely heavy loads, as such Satellite 6 and SAM 1 are not affected.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-5187?
CVE-2015-5187 has been classified as a medium severity vulnerability.
How do I fix CVE-2015-5187?
To fix CVE-2015-5187, it is recommended to monitor and control web traffic to reduce load and prevent timeouts.
What type of information can be leaked from CVE-2015-5187?
CVE-2015-5187 can leak sensitive information through Java exception statements generated during heavy traffic.
Which versions of Candlepin are affected by CVE-2015-5187?
CVE-2015-5187 affects all versions of Candlepin that are deployed.
Is there a workaround for CVE-2015-5187?
A suggested workaround for CVE-2015-5187 is to implement rate limiting on requests to the Candlepin service.