Description of problem: User can muck with a manifest file, upload it and it will still parse (in most reasonable cases, I imagine). Version-Release number of selected component (if applicable): How reproducible: Steps to Reproduce: 1. Get a manifest file. drill down into $manifest.zip > consumer_export.zip > export > entitlements 2. Modify the id value in the first line of the contained file. If you want, go ahead and rename the file to match the id string you just modified. 3. Attempt to import manifest file into CFSE Actual results: Manifest file is imported. Expected results: Manifest file should be rejected due to lack of signature integrity. Additional info: * Apparently a known backlog issue in candlepin - tracked here to assure visibility in QE. * Does this exist in the wild? If so, what's to stop a customer from staying on any existing CFSE install and hacking away at a manifest to their heart's content? I know such changes used to get rejected. Not sure how recent a development this is. External reference: https://github.com/candlepin/candlepin/commit/f4d93230e58b969c506b4c9778e04482a059b08c
This issue has been addressed in following products: Red Hat Subscription Asset Manager 1.2 Via RHSA-2013:0686 https://rhn.redhat.com/errata/RHSA-2013-0686.html
The Red Hat Security Response Team has rated this issue as having moderate security impact in CloudForms 1.1. This issue is not currently planned to be addressed in future updates.