Name: CVE-2021-4142: Authorization Bypass Through User-Controlled Key
Creator: Rapid7
Published: 2022-08-24T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2021-4142, CWE-639, CWE-287, CVSS 5.5, EPSS 0.00118

The Candlepin component of Red Hat Satellite was affected by an improper authentication flaw. Few factors could allow an attacker to use the SCA (simple content access) certificate for authentication with Candlepin.

CVSS Details

CVSS 3.1 Base Score: 5.5
CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Centos_linux	—	Upgrade rubygem-unf_extUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-amazing_printUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-unicode-display_widthUpgrade tfm-rubygem-hammer_cli_foremanUpgrade rubygem-domain_nameUpgrade rubygem-localeUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-netrcUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade satellite-cloneUpgrade tfm-rubygem-unfUpgrade rubygem-unicodeUpgrade foreman-cliUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade rubygem-mime-types-dataUpgrade rubygem-amazing_printUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-mime-types-dataUpgrade tfm-rubygem-mime-typesUpgrade rubygem-rest-clientUpgrade tfm-rubygem-fast_gettextUpgrade tfm-rubygem-clampUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-unfUpgrade rubygem-oauthUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-clampUpgrade tfm-rubygem-hammer_cli_katelloUpgrade rubygem-fast_gettextUpgrade tfm-rubygem-multi_jsonUpgrade rubygem-apipie-bindingsUpgrade rubygem-jwtUpgrade rubygem-hammer_cliUpgrade tfm-rubygem-unicodeUpgrade rubygem-hashieUpgrade rubygem-highlineUpgrade tfm-rubygem-rest-clientUpgrade rubygem-http-cookieUpgrade rubygem-little-pluggerUpgrade rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-little-pluggerUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade rubygem-loggingUpgrade tfm-rubygem-jwtUpgrade tfm-rubygem-domain_nameUpgrade rubygem-unicode-debugsourceUpgrade tfm-rubygem-powerbarUpgrade tfm-rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-localeUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-powerbarUpgrade rubygem-unf_ext-debugsourceUpgrade tfm-rubygem-oauthUpgrade tfm-rubygem-unf_extUpgrade tfm-rubygem-highlineUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade satellite-cliUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_tasksUpgrade tfm-rubygem-hammer_cliUpgrade rubygem-unicode-display_widthUpgrade tfm-rubygem-loggingUpgrade tfm-rubygem-http-cookieUpgrade satellite-maintainUpgrade rubygem-multi_jsonUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-unicode-debuginfoUpgrade tfm-rubygem-hashieUpgrade tfm-runtimeUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-netrc	Jul 14, 2022	Jul 5, 2022
Redhat_linux	—	Upgrade tfm-rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-highlineUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-oauthUpgrade tfm-rubygem-hammer_cli_foremanUpgrade tfm-rubygem-domain_nameUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-foreman_maintainUpgrade tfm-rubygem-netrcUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-fast_gettextUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-unfUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade rubygem-amazing_printUpgrade tfm-rubygem-mime-typesUpgrade rubygem-rest-clientUpgrade rubygem-clampUpgrade rubygem-hammer_cliUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-fast_gettextUpgrade rubygem-little-pluggerUpgrade tfm-rubygem-hammer_cli_katelloUpgrade rubygem-unfUpgrade rubygem-hashieUpgrade tfm-rubygem-clampUpgrade tfm-rubygem-unicode-display_widthUpgrade satellite-cloneUpgrade tfm-rubygem-multi_jsonUpgrade tfm-rubygem-amazing_printUpgrade rubygem-localeUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-unicode-debuginfoUpgrade rubygem-jwtUpgrade rubygem-unf_extUpgrade foreman-cliUpgrade rubygem-http-cookieUpgrade rubygem-mime-types-dataUpgrade tfm-rubygem-mime-types-dataUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foremanUpgrade tfm-rubygem-unf_extUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-rest-clientUpgrade tfm-rubygem-unicode-debuginfoUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade satellite-cliUpgrade rubygem-unicode-display_widthUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-apipie-bindingsUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-unicodeUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-domain_nameUpgrade tfm-rubygem-http-cookieUpgrade tfm-rubygem-loggingUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-jwtUpgrade tfm-runtimeUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-unf_ext-debugsourceUpgrade tfm-rubygem-hammer_cliUpgrade rubygem-unicodeUpgrade tfm-rubygem-hashieUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-netrcUpgrade rubygem-multi_jsonUpgrade tfm-rubygem-highlineUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-apipie-bindingsUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-oauthUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-localeUpgrade tfm-rubygem-powerbarUpgrade tfm-rubygem-little-pluggerUpgrade satellite-maintainUpgrade rubygem-powerbar	Jul 14, 2022	Jul 5, 2022
Rocky_linux	—	Upgrade libdb-cxx-debuginfoUpgrade libdb-cxxUpgrade libdb-utils-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-debugsourceUpgrade libdb-sql-devel-debuginfoUpgrade libdb-debuginfo	Mar 12, 2024	Aug 24, 2022

Prioritize with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritize with Active Threat Intelligence