Unscored severity · published Apr 2, 2013
CVE-2012-6119
Candlepin before 0.7.24, as used in Red Hat Subscription Asset Manager before 1.2.1, does not properly check manifest signatures, which allows local users to modify manifests
–
CVSS
0.4%
EPSS
No
On KEV
Description
Candlepin before 0.7.24, as used in Red Hat Subscription Asset Manager before 1.2.1, does not properly check manifest signatures, which allows local users to modify manifests.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CA
Candlepin · Candlepinproject
through 0.7.2; 0.4.5; 0.4.11; 0.4.27; 0.5.5; 0.6.3 · source: NVD
SA
Subscription Asset Manager · Redhat
through 1.2.0; 1.0.0; 1.1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-6119
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-6119
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-0686.html
Vendor Advisory
http://secunia.com/advisories/52774
www.osvdb.org
http://www.osvdb.org/91719
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=908613
github.com
https://github.com/candlepin/candlepin/blob/master/candlepin.spec
github.com
https://github.com/candlepin/candlepin/commit/f4d93230e58b969c506b4c9778e04482a059b08c
More from Candlepin
8.1
CVE-2023-1832
An improper access control flaw was found in Candlepin
6.5
CVE-2015-5187
Candlepin allows remote attackers to obtain sensitive information by obtaining Java exception statements as a result of excessive web traffic
5.5
CVE-2021-4142
The Candlepin component of Red Hat Satellite was affected by an improper authentication flaw