Описание
Candlepin before 0.7.24, as used in Red Hat Subscription Asset Manager before 1.2.1, does not properly check manifest signatures, which allows local users to modify manifests.
Ссылки
- Vendor Advisory
- Vendor Advisory
- Vendor Advisory
- Vendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 0.7.2 (включая)Версия до 1.2.0 (включая)
Одно из
cpe:2.3:a:candlepinproject:candlepin:*:*:*:*:*:*:*:*
cpe:2.3:a:candlepinproject:candlepin:0.4.5:*:*:*:*:*:*:*
cpe:2.3:a:candlepinproject:candlepin:0.4.11:*:*:*:*:*:*:*
cpe:2.3:a:candlepinproject:candlepin:0.4.27:*:*:*:*:*:*:*
cpe:2.3:a:candlepinproject:candlepin:0.5.5:*:*:*:*:*:*:*
cpe:2.3:a:candlepinproject:candlepin:0.6.3:*:*:*:*:*:*:*
cpe:2.3:a:redhat:subscription_asset_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:subscription_asset_manager:1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:subscription_asset_manager:1.1.0:*:*:*:*:*:*:*
EPSS
Процентиль: 18%
0.00057
Низкий
2.1 Low
CVSS2
Дефекты
CWE-264
Связанные уязвимости
redhat
больше 13 лет назад
Candlepin before 0.7.24, as used in Red Hat Subscription Asset Manager before 1.2.1, does not properly check manifest signatures, which allows local users to modify manifests.
debian
почти 13 лет назад
Candlepin before 0.7.24, as used in Red Hat Subscription Asset Manager ...
github
больше 3 лет назад
Candlepin before 0.7.24, as used in Red Hat Subscription Asset Manager before 1.2.1, does not properly check manifest signatures, which allows local users to modify manifests.
EPSS
Процентиль: 18%
0.00057
Низкий
2.1 Low
CVSS2
Дефекты
CWE-264