Vulnerability in Katello Installer

CVE-2013-4455

Katello Installer before 0.0.18 uses world-readable permissions for /etc/pki/tls/private/katello-node.key when deploying a child Pulp node, which allows local users to obtain the private key by reading the file.

EPSS: 0.005 (37.2th percentile) — read the EPSS interpretation.

Affected products

Katello Katello_installer — versions 0.0.1, 0.0.2, 0.0.3
N/a — versions n/a

Weakness classification (CWE)

CWE-264

References

secalert@redhat.com (x_refsource_MISC)
secalert@redhat.com (x_refsource_CONFIRM, Exploit, Patch)