CVE-2021-4142 Auth bypass in candlepin
An attacker can bypass authentication in Candlepin by exploiting improper handling of SCA certificates, potentially gaining unauthorized access.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-4142?
CVE-2021-4142 is a medium-severity authentication bypass vulnerability in candlepin, published on 24 Aug 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The Candlepin component of Red Hat Satellite was affected by an improper authentication flaw. Few factors could allow an attacker to use the SCA (simple content access) certificate for authentication with Candlepin.
Which versions are affected by CVE-2021-4142?
It affects 1 product.
Linux distribution packages (2)
candlepin Red Hat:satellite:6.10::el7 | All versions | 0:4.0.15-1.el7sat |
candlepin-selinux Red Hat:satellite:6.10::el7 | All versions | 0:4.0.15-1.el7sat |
Products include Candlepinproject Candlepin.
How do I fix CVE-2021-4142?
Apply the vendor's patch.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2021-4142 being exploited?
There is no known exploitation of CVE-2021-4142 in the wild and no public exploit code.
Other vulnerabilities in candlepin
Sources
Also known as GHSA-qjqc-gw55-mpmx, RHSA-2022:0790.