Unscored severity · published Mar 1, 2013
CVE-2012-6116
modules/certs/manifests/config.pp in katello-configure before 1.3.3.pulpv2 in Katello uses weak permissions (666) for the Candlepin bootstrap RPM, which allows local users to…
–
CVSS
0.2%
EPSS
No
On KEV
Description
modules/certs/manifests/config.pp in katello-configure before 1.3.3.pulpv2 in Katello uses weak permissions (666) for the Candlepin bootstrap RPM, which allows local users to modify the Candlepin CA certificate by writing to this file.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KA
Katello · Katello
All versions, or not specified · source: NVD
KA
Katello-configure · Katello
through 1.3.2_pulpv2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-6116
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-6116
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2013-0547.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2013-0686.html
secunia.com
http://secunia.com/advisories/52774
github.com
https://github.com/Katello/katello/commits/master/katello-configure/katello-configure.spec
github.com
https://github.com/jsomara/katello/commit/65f1e42b7bda0f3410931c50598540d944d8bf0d
More from Katello
8.8
CVE-2016-3072
Multiple SQL injection vulnerabilities in the scoped_search function in app/controllers/katello/api/v2/api_controller.rb in Katello allow remote authenticated users to execute…
4.3
CVE-2013-4201
Katello allows remote authenticated users to call the "system remove_deletion" CLI command via vectors related to "remove system" permissions
–
CVE-2014-3712
Katello allows remote attackers to cause a denial of service (memory consumption) via the (1) mode parameter in the setup_utils function in content_search_controller.rb or (2)…
–
CVE-2012-5561
script/katello-generate-passphrase in Katello 1.1 uses world-readable permissions for /etc/katello/secure/passphrase, which allows local users to obtain the passphrase by reading…