Bug 879369 (CVE-2012-5562) - CVE-2012-5562 rhn-proxy: may transmit credentials over clear-text
Summary: CVE-2012-5562 rhn-proxy: may transmit credentials over clear-text
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2012-5562
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 896693
Blocks: 879372 1011743
TreeView+ depends on / blocked
 
Reported: 2012-11-22 17:14 UTC by Vincent Danen
Modified: 2021-02-17 08:21 UTC (History)
17 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2014-01-24 21:00:55 UTC


Attachments (Terms of Use)

Description Vincent Danen 2012-11-22 17:14:54 UTC
It was found that when RHN Proxy was used as a proxy to connect to RHN Satellite, certain pages that should have been protected via SSL (in direct to Satellite connections) were in fact only protected between RHN Proxy and RHN Satellite; the connection between the client and RHN Proxy was not protected via SSL.  This could leak confidential information or authentication credentials when accessing RHN Satellite via RHN Proxy.

By default, yum clients and rhn_register will always communicate with RHN Proxy over HTTPS.

Comment 3 Jan Pazdziora 2012-11-26 10:42:32 UTC
(In reply to comment #0)
> It was found that when RHN Proxy was used as a proxy to connect to RHN
> Satellite, certain pages that should have been protected via SSL (in direct

Could you please list these "certain pages"?

Comment 6 Vincent Danen 2012-11-28 18:14:29 UTC
(In reply to comment #3)
> (In reply to comment #0)
> > It was found that when RHN Proxy was used as a proxy to connect to RHN
> > Satellite, certain pages that should have been protected via SSL (in direct
> 
> Could you please list these "certain pages"?

 - "/Login.do"
 - "/ReLogin.do"

Comment 23 Kurt Seifried 2014-01-24 21:00:55 UTC
Statement:

This issue was corrected in RHN Satellite 5.6; earlier versions of RHN Satellite are affected.  As RHN Satellite is now in the Production 2 phase of its support and maintenance life cycle, there are currently no plans to address this in future updates for RHN Satellite 5.5 and earlier.  For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/site/support/policy/updates/satellite.

Comment 25 Kurt Seifried 2014-02-10 18:34:31 UTC
This was addressed in the Satellite-Proxy 5.6.0 release available at:

https://rhn.redhat.com/errata/RHEA-2013-1392.html


Note You need to log in before you can comment on or make changes to this bug.