CVE-2021-4142
First published: Mon Dec 20 2021(Updated: )
The Candlepin component of Red Hat Satellite was affected by an improper authentication flaw. Few factors could allow an attacker to use the SCA (simple content access) certificate for authentication with Candlepin.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Candlepinproject Candlepin | >=3.1.0<=3.1.28-2 | |
| Candlepinproject Candlepin | >=3.2.0<=3.2.21-1 | |
| Candlepinproject Candlepin | >=4.1.0<=4.1.8-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/security/cve/CVE-2021-4142
- https://bugzilla.redhat.com/show_bug.cgi?id=2034346
- https://github.com/candlepin/candlepin/pull/3197
- https://github.com/candlepin/candlepin/pull/3198
- https://github.com/candlepin/candlepin/pull/3199
- https://access.redhat.com/errata/RHSA-2022:0790
- https://access.redhat.com/security/cve/cve-2021-4142
- https://access.redhat.com/errata/RHSA-2022:5498
Frequently Asked Questions
What is CVE-2021-4142?
CVE-2021-4142 is a vulnerability in the Candlepin component of Red Hat Satellite that allows an attacker to use the SCA certificate for authentication.
How does CVE-2021-4142 affect Red Hat Satellite?
CVE-2021-4142 affects Red Hat Satellite by exposing an improper authentication flaw in the Candlepin component.
What factors could allow an attacker to exploit CVE-2021-4142?
An attacker could exploit CVE-2021-4142 by using the SCA certificate for authentication with Candlepin.
What is the severity of CVE-2021-4142?
CVE-2021-4142 has a severity rating of medium with a CVSS score of 5.5.
How can I fix CVE-2021-4142?
To fix CVE-2021-4142, it is recommended to update Red Hat Satellite to the latest version and apply any relevant patches.
- collector/nvd-index
- agent/weakness
- agent/last-modified-date
- agent/first-publish-date
- agent/softwarecombine
- agent/remedy
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2021-4142
- agent/references
- agent/author
- agent/severity
- agent/type
- agent/description
- agent/event
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/candlepinproject
- canonical/candlepinproject candlepin
- version/candlepinproject candlepin/3.1.0
- version/candlepinproject candlepin/3.1.28-2
- version/candlepinproject candlepin/3.2.0
- version/candlepinproject candlepin/3.2.21-1
- version/candlepinproject candlepin/4.1.0
- version/candlepinproject candlepin/4.1.8-1