CVE-2016-4455
14.04.2017, 18:59
The Subscription Manager package (aka subscription-manager) before 1.17.7-1 for Candlepin uses weak permissions (755) for subscription-manager cache directories, which allows local users to obtain sensitive information by reading files in the directories.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| redhat | enterprise_linux_desktop | 6.0 |
| redhat | enterprise_linux_desktop | 7.0 |
| redhat | enterprise_linux_hpc_node | 6.0 |
| redhat | enterprise_linux_hpc_node | 7.0 |
| redhat | enterprise_linux_server | 6.0 |
| redhat | enterprise_linux_server | 7.0 |
| redhat | enterprise_linux_workstation | 6.0 |
| redhat | enterprise_linux_workstation | 7.0 |
| redhat | subscription-manager | 𝑥 ≤ 1.17.6-1 |
𝑥
= Vulnerable software versions
Red Hat Enterprise Linux Releases
Red Hat Product | |||||
|---|---|---|---|---|---|
| python-rhsm |
| ||||
| python-rhsm-certificates |
| ||||
| subscription-manager |
| ||||
| subscription-manager-firstboot |
| ||||
| subscription-manager-gui |
| ||||
| subscription-manager-initial-setup-addon |
| ||||
| subscription-manager-migration |
| ||||
| subscription-manager-migration-data |
| ||||
| subscription-manager-plugin-container |
| ||||
| subscription-manager-plugin-ostree |
|
Common Weakness Enumeration
References