5.5

CVE-2021-4142

The Candlepin component of Red Hat Satellite was affected by an improper authentication flaw. Few factors could allow an attacker to use the SCA (simple content access) certificate for authentication with Candlepin.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Candlepinproject ≫ Candlepin Version >= 3.1.0 <= 3.1.28-2
Candlepinproject ≫ Candlepin Version >= 3.2.0 <= 3.2.21-1
Candlepinproject ≫ Candlepin Version >= 4.1.0 <= 4.1.8-1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.17% 0.061
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

CWE-639 Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

https://access.redhat.com/security/cve/CVE-2021-4142
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2034346
Vendor Advisory
Issue Tracking
https://github.com/candlepin/candlepin/pull/3197
Patch
Third Party Advisory
https://github.com/candlepin/candlepin/pull/3198
Third Party Advisory
https://github.com/candlepin/candlepin/pull/3199
Patch
Third Party Advisory