REDHAT-BUG-1858284
First published: Fri Jul 17 2020(Updated: )
Red Hat Satellite 6 allows local user of instance to read cache files. These credentials give full access via the API and local user on the foreman server can gain complete access of the instance.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Red Hat Satellite with Embedded Oracle |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1858284#c5
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1858284#c6
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1858302
- https://access.redhat.com/errata/RHSA-2020:4127
- https://access.redhat.com/security/cve/cve-2020-14334
- https://access.redhat.com/errata/RHSA-2020:4366
- https://bugzilla.redhat.com/show_bug.cgi?id=1858284
Frequently Asked Questions
What is the severity of REDHAT-BUG-1858284?
The severity of REDHAT-BUG-1858284 is critical due to the potential for local users to gain full access to the API.
How do I fix REDHAT-BUG-1858284?
To fix REDHAT-BUG-1858284, update Red Hat Satellite to the latest version that contains the security patches.
Who is affected by REDHAT-BUG-1858284?
Any local user with access to an instance of Red Hat Satellite 6 may be affected by REDHAT-BUG-1858284.
What are the risks associated with REDHAT-BUG-1858284?
The risks associated with REDHAT-BUG-1858284 include unauthorized access to sensitive data and potential manipulation of instance settings.
Is there a workaround for REDHAT-BUG-1858284 before a fix is available?
A temporary workaround for REDHAT-BUG-1858284 is to restrict local user access until a patch is applied.
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2020-14334
- agent/severity
- agent/references
- agent/description
- agent/event
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/red hat
- canonical/red hat satellite with embedded oracle