Описание
Candlepin before 0.7.24, as used in Red Hat Subscription Asset Manager before 1.2.1, does not properly check manifest signatures, which allows local users to modify manifests.
Ссылки
- Vendor Advisory
- Vendor Advisory
- Vendor Advisory
- Vendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 0.7.2 (включая)Версия до 1.2.0 (включая)
Одно из
cpe:2.3:a:candlepinproject:candlepin:*:*:*:*:*:*:*:*
cpe:2.3:a:candlepinproject:candlepin:0.4.5:*:*:*:*:*:*:*
cpe:2.3:a:candlepinproject:candlepin:0.4.11:*:*:*:*:*:*:*
cpe:2.3:a:candlepinproject:candlepin:0.4.27:*:*:*:*:*:*:*
cpe:2.3:a:candlepinproject:candlepin:0.5.5:*:*:*:*:*:*:*
cpe:2.3:a:candlepinproject:candlepin:0.6.3:*:*:*:*:*:*:*
cpe:2.3:a:redhat:subscription_asset_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:subscription_asset_manager:1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:subscription_asset_manager:1.1.0:*:*:*:*:*:*:*
EPSS
Процентиль: 35%
0.00423
Низкий
2.1 Low
CVSS2
Дефекты
CWE-264
Связанные уязвимости
redhat
около 14 лет назад
Candlepin before 0.7.24, as used in Red Hat Subscription Asset Manager before 1.2.1, does not properly check manifest signatures, which allows local users to modify manifests.
debian
больше 13 лет назад
Candlepin before 0.7.24, as used in Red Hat Subscription Asset Manager ...
github
около 4 лет назад
Candlepin before 0.7.24, as used in Red Hat Subscription Asset Manager before 1.2.1, does not properly check manifest signatures, which allows local users to modify manifests.
EPSS
Процентиль: 35%
0.00423
Низкий
2.1 Low
CVSS2
Дефекты
CWE-264