Bug 879369 (CVE-2012-5562)
Summary: | CVE-2012-5562 rhn-proxy: may transmit credentials over clear-text | ||
---|---|---|---|
Product: | [Other] Security Response | Reporter: | Vincent Danen <vdanen> |
Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
Status: | CLOSED ERRATA | QA Contact: | |
Severity: | medium | Docs Contact: | |
Priority: | medium | ||
Version: | unspecified | CC: | adellape, clocklea, cperry, dyordano, ggainey, jmoran, jpazdziora, kseifried, meissner, mmraka, ngreene, pvn, security-response-team, sherr, taw, thomas, tlestach |
Target Milestone: | --- | Keywords: | Security |
Target Release: | --- | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | Doc Type: | Bug Fix | |
Doc Text: | Story Points: | --- | |
Clone Of: | Environment: | ||
Last Closed: | 2014-01-24 21:00:55 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | 896693 | ||
Bug Blocks: | 879372, 1011743 |
Description
Vincent Danen
2012-11-22 17:14:54 UTC
(In reply to comment #0) > It was found that when RHN Proxy was used as a proxy to connect to RHN > Satellite, certain pages that should have been protected via SSL (in direct Could you please list these "certain pages"? (In reply to comment #3) > (In reply to comment #0) > > It was found that when RHN Proxy was used as a proxy to connect to RHN > > Satellite, certain pages that should have been protected via SSL (in direct > > Could you please list these "certain pages"? - "/Login.do" - "/ReLogin.do" Statement: This issue was corrected in RHN Satellite 5.6; earlier versions of RHN Satellite are affected. As RHN Satellite is now in the Production 2 phase of its support and maintenance life cycle, there are currently no plans to address this in future updates for RHN Satellite 5.5 and earlier. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/site/support/policy/updates/satellite. This was addressed in the Satellite-Proxy 5.6.0 release available at: https://rhn.redhat.com/errata/RHEA-2013-1392.html |