Medium severity · published Aug 24, 2022
CVE-2021-4142
The Candlepin component of Red Hat Satellite was affected by an improper authentication flaw
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
The Candlepin component of Red Hat Satellite was affected by an improper authentication flaw. Few factors could allow an attacker to use the SCA (simple content access) certificate for authentication with Candlepin.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CA
Candlepin · Candlepinproject
3.1.0 through 3.1.28-2; 3.2.0 through 3.2.21-1; 4.1.0 through 4.1.8-1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-4142
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-4142
Vendor Advisory
https://access.redhat.com/security/cve/CVE-2021-4142
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2034346
Patch
https://github.com/candlepin/candlepin/pull/3197
Third Party Advisory
https://github.com/candlepin/candlepin/pull/3198
Patch
https://github.com/candlepin/candlepin/pull/3199
More from Candlepin
8.1
CVE-2023-1832
An improper access control flaw was found in Candlepin
6.5
CVE-2015-5187
Candlepin allows remote attackers to obtain sensitive information by obtaining Java exception statements as a result of excessive web traffic
–
CVE-2012-6119
Candlepin before 0.7.24, as used in Red Hat Subscription Asset Manager before 1.2.1, does not properly check manifest signatures, which allows local users to modify manifests