CVE-2020-10710: Medium severity the foreman vulnerability
A flaw was found where the Plaintext Candlepin password is disclosed while updating Red Hat Satellite through the satellite-installer. This flaw allows an attacker with sufficiently high privileges, such as root, to retrieve the Candlepin plaintext password.
Other sources
Plaintext Candlepin password disclosed while updating Red Hat Satellite through satellite-installer. An attacker with sufficiently high privileges, such as root, can retrieve Candlepin plaintext password.
References:
https://bugzilla.redhat.com/showbug.cgi?id=1809497
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-10710?
CVE-2020-10710 is a vulnerability that allows an attacker with root privileges to retrieve the Candlepin plaintext password while updating Red Hat Satellite through the satellite-installer.
What is the severity of CVE-2020-10710?
The severity of CVE-2020-10710 is medium with a CVSS score of 4.4.
Which software versions are affected by CVE-2020-10710?
Theforeman Foreman version up to and excluding 1.24.1.22 and redhat/foreman-installer version up to and excluding 1.24.1.22 are affected by CVE-2020-10710.
How can an attacker exploit CVE-2020-10710?
An attacker with sufficiently high privileges, such as root, can exploit CVE-2020-10710 to retrieve the Candlepin plaintext password.
Is there a fix available for CVE-2020-10710?
Yes, upgrading to versions higher than 1.24.1.22 for Theforeman Foreman and redhat/foreman-installer will fix the vulnerability.