Name: CVE-2021-4142: Authorization Bypass Through User-Controlled Key
Creator: Rapid7
Published: 2022-08-24T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2021-4142, CWE-639, CWE-287, CVSS 5.5, EPSS 0.00118

The Candlepin component of Red Hat Satellite was affected by an improper authentication flaw. Few factors could allow an attacker to use the SCA (simple content access) certificate for authentication with Candlepin.

CVSS Details

CVSS 3.1 Base Score: 5.5
CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Centos_linux	—	Upgrade tfm-rubygem-powerbarUpgrade tfm-rubygem-domain_nameUpgrade tfm-rubygem-apipie-bindingsUpgrade rubygem-multi_jsonUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-unicode-debugsourceUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-oauthUpgrade rubygem-unf_ext-debugsourceUpgrade tfm-rubygem-localeUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_adminUpgrade satellite-maintainUpgrade tfm-rubygem-highlineUpgrade tfm-rubygem-unf_extUpgrade satellite-cliUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade rubygem-powerbarUpgrade rubygem-hammer_cli_foremanUpgrade tfm-rubygem-http-cookieUpgrade tfm-rubygem-jwtUpgrade tfm-rubygem-loggingUpgrade tfm-runtimeUpgrade rubygem-netrcUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-hashieUpgrade tfm-rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-loggingUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade rubygem-little-pluggerUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-unicode-display_widthUpgrade tfm-rubygem-little-pluggerUpgrade tfm-rubygem-hammer_cliUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_tasksUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-clampUpgrade tfm-rubygem-hammer_cli_katelloUpgrade tfm-rubygem-amazing_printUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-amazing_printUpgrade tfm-rubygem-unicodeUpgrade tfm-rubygem-mime-types-dataUpgrade rubygem-rest-clientUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cliUpgrade rubygem-unicode-debuginfoUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-fast_gettextUpgrade tfm-rubygem-mime-typesUpgrade rubygem-unf_extUpgrade tfm-rubygem-unicode-display_widthUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-hammer_cli_foremanUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-domain_nameUpgrade rubygem-http-cookieUpgrade rubygem-apipie-bindingsUpgrade tfm-rubygem-rest-clientUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-localeUpgrade rubygem-highlineUpgrade rubygem-hashieUpgrade rubygem-jwtUpgrade tfm-rubygem-multi_jsonUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade rubygem-fast_gettextUpgrade foreman-cliUpgrade tfm-rubygem-unfUpgrade satellite-cloneUpgrade rubygem-unicodeUpgrade rubygem-unfUpgrade rubygem-mime-types-dataUpgrade tfm-rubygem-netrcUpgrade rubygem-oauthUpgrade tfm-rubygem-clamp	Jul 14, 2022	Jul 5, 2022
Redhat_linux	—	Upgrade rubygem-hammer_cli_foremanUpgrade tfm-rubygem-unicodeUpgrade tfm-rubygem-rest-clientUpgrade tfm-rubygem-unicode-debuginfoUpgrade tfm-rubygem-powerbarUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade satellite-maintainUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-apipie-bindingsUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-unicode-display_widthUpgrade tfm-rubygem-hashieUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-unf_ext-debugsourceUpgrade tfm-rubygem-localeUpgrade rubygem-domain_nameUpgrade tfm-rubygem-http-cookieUpgrade rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-little-pluggerUpgrade rubygem-mime-typesUpgrade tfm-rubygem-jwtUpgrade tfm-rubygem-oauthUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-runtimeUpgrade tfm-rubygem-highlineUpgrade rubygem-multi_jsonUpgrade rubygem-unicode-debugsourceUpgrade tfm-rubygem-loggingUpgrade rubygem-unicodeUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_katelloUpgrade tfm-rubygem-hammer_cliUpgrade rubygem-hammer_cli_foreman_templatesUpgrade satellite-cliUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-apipie-bindingsUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-unf_extUpgrade rubygem-powerbarUpgrade rubygem-little-pluggerUpgrade rubygem-oauthUpgrade rubygem-loggingUpgrade tfm-rubygem-unfUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-highlineUpgrade tfm-rubygem-hammer_cli_foremanUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-fast_gettextUpgrade rubygem-mime-types-dataUpgrade rubygem-rest-clientUpgrade rubygem-clampUpgrade rubygem-amazing_printUpgrade rubygem-unicode-debuginfoUpgrade tfm-rubygem-amazing_printUpgrade rubygem-http-cookieUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-multi_jsonUpgrade rubygem-hashieUpgrade rubygem-unf_extUpgrade tfm-rubygem-clampUpgrade rubygem-unfUpgrade tfm-rubygem-hammer_cli_katelloUpgrade foreman-cliUpgrade rubygem-localeUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cliUpgrade tfm-rubygem-mime-types-dataUpgrade tfm-rubygem-fast_gettextUpgrade tfm-rubygem-netrcUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-domain_nameUpgrade tfm-rubygem-mime-typesUpgrade satellite-cloneUpgrade rubygem-jwtUpgrade tfm-rubygem-hammer_cli_foreman_tasks	Jul 14, 2022	Jul 5, 2022
Rocky_linux	—	Upgrade libdb-cxx-debuginfoUpgrade libdb-cxxUpgrade libdb-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-debugsourceUpgrade libdb-utils-debuginfoUpgrade libdb-sql-debuginfo	Mar 12, 2024	Aug 24, 2022

Prioritize with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritize with Active Threat Intelligence