REDHAT-BUG-872487
First published: Fri Nov 02 2012(Updated: )
During an audit of file permissions within CloudForms it was found that the /etc/pulp/pulp.conf is world readable. This file can contain the following sensitive information: # default_password: default password for admin # Highly recommend changing the default_password with "pulp-admin user update" # [server] ... default_login: admin default_password: CVkiDB/JKHhHp7+PlkfaqizG ... oauth_key: katello oauth_secret: zH9ZXu6JhDwlx9GjshbFaa0Q This file should not be world readable, it should only be readable by the user/group that pulp runs as.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Red Hat CloudForms Management Engine |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of REDHAT-BUG-872487?
The severity of REDHAT-BUG-872487 is considered high due to the exposure of sensitive information in world-readable file permissions.
How do I fix REDHAT-BUG-872487?
To fix REDHAT-BUG-872487, restrict the permissions on the /etc/pulp/pulp.conf file to ensure it is not world-readable.
What information is exposed by REDHAT-BUG-872487?
REDHAT-BUG-872487 exposes sensitive information such as the default password for the admin user in the /etc/pulp/pulp.conf file.
Which software is affected by REDHAT-BUG-872487?
REDHAT-BUG-872487 affects Red Hat CloudForms Management Engine.
What are the potential risks of REDHAT-BUG-872487?
The potential risks of REDHAT-BUG-872487 include unauthorized access to sensitive credentials, which could lead to a full compromise of the CloudForms environment.
- agent/references
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2012-4574
- agent/severity
- agent/description
- agent/event
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/red hat
- canonical/red hat cloudforms management engine