A security flaw was found in the way rhn-migrate-classic-to-rhsm tool of subscription-manager, a suite of tools and libraries for subscription and repository management, performed migration of system profiles, registered with Red Hat Network Classic to Customer Portal Subscription Management (certificate of Red Hat Network Classic server was not verified for validity). A rogue server could use this flaw to conduct man-in-the-middle (MiTM) attacks, possibly leading to their ability to obtain user credentials, that would be used for authentication of that particular user at Red Hat Network Classic server before the system profile(s) migration.

This issue was found by Florian Weimer of Red Hat Product Security Team.

Plain password from RHSM in the logs during OSP13 deployment with subscription-manager. overcloudinstall.log contains a plaintext password after overcloud creation. See https://bugzilla.redhat.com/showbug.cgi?id=1961709

/var/lib/rhsm/cache/entitlementstatus.json and /var/lib/rhsm/facts/facts.json are world readable but contain sensitive information (Red Hat Contract number and hardware serial number, sufficient to authenticate again Red Hat and hardware vendor support) can could be used by an attacker to perform a social engineering attack.

Upstream patch:

https://github.com/candlepin/subscription-manager/commit/9dec31