CVE-2019-3891: High severity red hat satellite vulnerability
A vulnerability was found in the way Satellite 6 installer logs the calls to Candlepins cpdb. The /var/log/candlepin/cpdb.log log file permissions allows a non privileged user to read credentials information from the log files.
Bug report: https://bugzilla.redhat.com/showbug.cgi?id=1692703
Other sources
It was discovered that a world-readable log file belonging to Candlepin component of Red Hat Satellite 6.4 leaked the credentials of the Candlepin database. A malicious user with local access to a Satellite host can use those credentials to modify the database and prevent Satellite from fetching package updates, thus preventing all Satellite hosts from accessing those updates.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-3891?
CVE-2019-3891 is classified as a high severity vulnerability due to the potential exposure of sensitive database credentials.
How do I fix CVE-2019-3891?
To fix CVE-2019-3891, update the Candlepin component to version 2.4.15 or 2.5.15 as recommended by Red Hat.
What impact does CVE-2019-3891 have on Red Hat Satellite 6.4?
CVE-2019-3891 allows a local attacker to access sensitive database credentials, enabling unauthorized modifications to the database.
Is CVE-2019-3891 specific to a certain version of software?
Yes, CVE-2019-3891 specifically affects Candlepin versions prior to 2.4.15 and 2.5.15 in Red Hat Satellite 6.4.
Who can exploit CVE-2019-3891?
A malicious user with local access to a Satellite host can exploit CVE-2019-3891 to compromise the system.