Name: CVE-2021-4142: Authorization Bypass Through User-Controlled Key
Creator: Rapid7
Published: 2022-08-24T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2021-4142, CWE-639, CWE-287, CVSS 5.5, EPSS 0.00174

The Candlepin component of Red Hat Satellite was affected by an improper authentication flaw. Few factors could allow an attacker to use the SCA (simple content access) certificate for authentication with Candlepin.

CVSS Details

CVSS 3.1 Base Score: 5.5
CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Centos_linux	—	Upgrade tfm-rubygem-unicodeUpgrade tfm-rubygem-mime-types-dataUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-unicode-display_widthUpgrade tfm-rubygem-hammer_cli_foremanUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-domain_nameUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-rest-clientUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade foreman-cliUpgrade rubygem-mime-types-dataUpgrade rubygem-fast_gettextUpgrade rubygem-clampUpgrade tfm-rubygem-hammer_cli_katelloUpgrade tfm-rubygem-unfUpgrade rubygem-amazing_printUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-rubygem-clampUpgrade rubygem-oauthUpgrade rubygem-hammer_cliUpgrade rubygem-unf_extUpgrade tfm-rubygem-amazing_printUpgrade tfm-rubygem-multi_jsonUpgrade rubygem-unicode-debuginfoUpgrade tfm-rubygem-mime-typesUpgrade tfm-rubygem-fast_gettextUpgrade rubygem-http-cookieUpgrade rubygem-unfUpgrade satellite-cloneUpgrade tfm-rubygem-netrcUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-unicodeUpgrade rubygem-localeUpgrade rubygem-jwtUpgrade rubygem-hashieUpgrade rubygem-highlineUpgrade tfm-rubygem-rest-clientUpgrade rubygem-apipie-bindingsUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_openscapUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade rubygem-loggingUpgrade rubygem-little-pluggerUpgrade rubygem-hammer_cli_foreman_templatesUpgrade tfm-runtimeUpgrade tfm-rubygem-jwtUpgrade tfm-rubygem-powerbarUpgrade tfm-rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-oauthUpgrade tfm-rubygem-localeUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-powerbarUpgrade rubygem-hammer_cli_foremanUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-unf_extUpgrade tfm-rubygem-highlineUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade satellite-cliUpgrade rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foreman_tasksUpgrade tfm-rubygem-hammer_cliUpgrade tfm-rubygem-loggingUpgrade tfm-rubygem-http-cookieUpgrade tfm-rubygem-domain_nameUpgrade satellite-maintainUpgrade rubygem-unicode-debugsourceUpgrade rubygem-multi_jsonUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-unicode-debuginfoUpgrade tfm-rubygem-hashieUpgrade rubygem-netrcUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-little-plugger	Jul 14, 2022	Jul 5, 2022
Redhat_linux	—	Upgrade rubygem-hammer_cli_katelloUpgrade rubygem-hammer_cli_foremanUpgrade tfm-rubygem-unicode-debuginfoUpgrade tfm-rubygem-unicodeUpgrade tfm-rubygem-rest-clientUpgrade rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-loggingUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade satellite-cliUpgrade tfm-runtimeUpgrade rubygem-apipie-bindingsUpgrade rubygem-domain_nameUpgrade tfm-rubygem-jwtUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-rubygem-unf_extUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-localeUpgrade rubygem-unf_ext-debugsourceUpgrade satellite-maintainUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade rubygem-powerbarUpgrade rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-hashieUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-multi_jsonUpgrade rubygem-netrcUpgrade tfm-rubygem-little-pluggerUpgrade tfm-rubygem-powerbarUpgrade tfm-rubygem-highlineUpgrade rubygem-mime-typesUpgrade tfm-rubygem-http-cookieUpgrade rubygem-unicode-display_widthUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-unicodeUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-hammer_cliUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-oauthUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-unfUpgrade tfm-rubygem-unicode-display_widthUpgrade rubygem-mime-types-dataUpgrade tfm-rubygem-fast_gettextUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-mime-types-dataUpgrade tfm-rubygem-netrcUpgrade rubygem-clampUpgrade rubygem-little-pluggerUpgrade tfm-rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-rest-clientUpgrade rubygem-unicode-debuginfoUpgrade tfm-rubygem-amazing_printUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade rubygem-fast_gettextUpgrade rubygem-highlineUpgrade rubygem-amazing_printUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade rubygem-oauthUpgrade tfm-rubygem-hammer_cli_katelloUpgrade rubygem-unfUpgrade satellite-cloneUpgrade rubygem-unf_extUpgrade rubygem-hashieUpgrade tfm-rubygem-clampUpgrade tfm-rubygem-multi_jsonUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-hammer_cli_foremanUpgrade rubygem-http-cookieUpgrade rubygem-jwtUpgrade tfm-rubygem-mime-typesUpgrade rubygem-loggingUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-foreman_maintainUpgrade rubygem-localeUpgrade rubygem-hammer_cliUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade foreman-cli	Jul 14, 2022	Jul 5, 2022
Rocky_linux	—	Upgrade libdb-cxx-debuginfoUpgrade libdb-cxxUpgrade libdb-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-debugsource	Mar 12, 2024	Aug 24, 2022

Prioritise with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritise with Active Threat Intelligence