CVE-2021-4142
24.08.2022, 16:15
The Candlepin component of Red Hat Satellite was affected by an improper authentication flaw. Few factors could allow an attacker to use the SCA (simple content access) certificate for authentication with Candlepin.Enginsight
| Vendor | Product | Version |
|---|---|---|
| candlepinproject | candlepin | 3.1.0 ≤ 𝑥 ≤ 3.1.28-2 |
| candlepinproject | candlepin | 3.2.0 ≤ 𝑥 ≤ 3.2.21-1 |
| candlepinproject | candlepin | 4.1.0 ≤ 𝑥 ≤ 4.1.8-1 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-639 - Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
- CWE-287 - Improper AuthenticationWhen an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.
References