Insufficiently Protected Credentials Affecting katello package, versions <3.13.0.rc1
Threat Intelligence
EPSS
0.05% (25th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUBY-KATELLO-535520
- published 25 Nov 2019
- disclosed 25 Nov 2019
- credit Unknown
Introduced: 25 Nov 2019
CVE-2019-14825 Open this link in a new tabHow to fix?
Upgrade katello to version 3.13.0.rc1 or higher.
Overview
katello is a package that adds Content and Subscription Management to Foreman
Affected versions of this package are vulnerable to Insufficiently Protected Credentials. Registry credentials used during container image discovery were inadvertently logged without being masked. This flaw could expose the registry credentials to other privileged users.
References
CVSS Scores
version 3.1