CVE-2023-1832: Improper authorization check in the server component
An improper access control flaw was found in Candlepin. An attacker can create data scoped under another customer/tenant, which can result in loss of confidentiality and availability for the affected customer/tenant.
Other sources
An improper access control flaw was found in Candlepin. This issue enables a customer/tenant to create data scoped under another customer/tenant, and can result in loss of confidentiality and availability for the affected customer/tenant.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2023-1832?
CVE-2023-1832 is an improper access control flaw found in Candlepin that can result in loss of confidentiality and availability for the affected customer.
How does CVE-2023-1832 affect Candlepin?
CVE-2023-1832 affects Candlepin by allowing an attacker to create data scoped under another customer/tenant, compromising confidentiality and availability.
What is the severity of CVE-2023-1832?
The severity of CVE-2023-1832 is high, with a CVSS score of 8.1.
Which versions of Candlepin are affected by CVE-2023-1832?
Candlepin versions 4.3.7 (up to exclusive 3) and 4.3.8 (up to exclusive 1) are affected by CVE-2023-1832.
How can I fix CVE-2023-1832?
To fix CVE-2023-1832, upgrade to Candlepin version 4.3.7 (exclusive 3) or 4.3.8 (exclusive 1).