The Subscription Manager package (aka subscription-manager) before 1.17.7-1 for Candlepin uses weak permissions (755) for subscription-manager cache directories, which allows local users to obtain sensitive information by reading files in the directories.
CVSS Details
- CVSS 3.1 Base Score: 3.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade subscription-manager-guiUpgrade subscription-manager-debuginfoUpgrade python-rhsm-debuginfoUpgrade subscription-manager-plugin-containerUpgrade python-rhsmUpgrade subscription-manager-migration-dataUpgrade subscription-managerUpgrade subscription-manager-migrationUpgrade python-rhsm-certificatesUpgrade subscription-manager-firstboot | Aug 28, 2019 | Apr 14, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade python-rhsm-certificatesUpgrade python-rhsmUpgrade subscription-managerUpgrade subscription-manager-gui | Nov 30, 2017 | Apr 14, 2017 |
| Redhat_linux | — | Upgrade python-rhsmNo solution existsUpgrade python-rhsm-debuginfoUpgrade subscription-managerUpgrade subscription-manager-debuginfoUpgrade python-rhsm-certificatesUpgrade subscription-manager-guiUpgrade subscription-manager-firstbootUpgrade subscription-manager-migrationUpgrade subscription-manager-migration-dataUpgrade subscription-manager-plugin-container | Nov 4, 2016 | Nov 3, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub