CVE-2019-3891: red hat candlepin

Vulnerability summary

CVE-2019-3891 is a high (CVSS 7.8) vulnerability in red hat candlepin. EPSS estimates a 0.68% chance of exploitation in the next 30 days, higher than 51.4% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 12-04-2019
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

It was discovered that a world-readable log file belonging to Candlepin component of Red Hat Satellite 6.4 leaked the credentials of the Candlepin database. A malicious user with local access to a Satellite host can use those credentials to modify the database and prevent Satellite from fetching package updates, thus preventing all Satellite hosts from accessing those updates.

• CWE-532Insertion of Sensitive Information into Log FileThe product writes sensitive information to a log file.