GHSA-m4wh-848j-9w2r CVE-2019-14825
Katello cleartext password storage issue
- Severity
- 2.7 / 10
- Low · CVSS 3.1
- Exploit chance (EPSS)
- 0.65%
- Chance of exploitation in the next 30 days. Higher than 51.27% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-312 Cleartext Storage of Sensitive Information
- Fix
3.12.2- Upgrade katello to this version or later
Description
A cleartext password storage issue was discovered in Katello, versions 3.x.x.x before katello 3.12.2. Registry credentials used during container image discovery were inadvertently logged without being masked. This flaw could expose the registry credentials to other privileged users.
Affected versions
RubyGems
| Package | Vulnerable | Fixed in |
|---|---|---|
| katello | >= 3.0.0.0, < 3.12.2 |
3.12.2 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
katello RubyGems → 3.12.2
- bundler
bundle update katello # Gemfile: gem "katello", ">= 3.12.2"
Severity breakdown
CVSS 3.1 2.7
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- High
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Weakness
CWE-312: Cleartext Storage of Sensitive Information
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
How to prevent it
- Implementation, System Configuration, Operation: When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to encrypt the data at rest. [REF-1297] [REF-1299] [REF-1301]
- Implementation, System Configuration, Operation: In some systems/environments such as cloud, the use of "double encryption" (at both the software and hardware layer) might be required, and the developer might be solely responsible for both layers, instead of shared responsibility with the administrator of the broader system/environment.
References
Advisories
Packages
Other links
- github.com/Katello/katello/pull/8244
- github.com/Katello/katello/pull/8253
- github.com/Katello/katello/commit/332484232b66b7907a8104a19ea97eb697b75c79
- github.com/Katello/katello/commit/4eefa678a905140620ca8b390d48fe318d36e4ea
- access.redhat.com/errata/RHSA-2019:3172
- access.redhat.com/security/cve/CVE-2019-14825
- bugzilla.redhat.com/show_bug.cgi
- bugzilla.redhat.com/show_bug.cgi
- bugzilla.redhat.com/show_bug.cgi
- github.com/Katello/katello/commits/3.12.2
- github.com/rubysec/ruby-advisory-db/blob/master/gems/katello/CVE-2019-14825.yml
- projects.theforeman.org/issues/27485
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-c43c-rf7g-5xpg katello: missing repository authorization in content_uploads exposes cross-product content existence | Medium | Also affects katello |
| GHSA-fwj4-6wgp-mpxm Katello: Denial of Service and potential information disclosure via SQL injection | Medium | Also affects katello |
| GHSA-5xv2-q475-rwrh Katello uses hard coded credential | Critical | Also affects katello |
| GHSA-527r-mfmj-prqf Katello SQL Injection vulnerabilities | High | Also affects katello |
| GHSA-mhhc-r88h-2qrm katello Cross-site Scripting vulnerability | Medium | Also affects katello |
| GHSA-cpv6-pfq6-j2v7 katello Improper Privilege Management vulnerability | Medium | Also affects katello |
| GHSA-jx5v-788g-qw58 katello SQL Injection vulnerability | Medium | Also affects katello |
| GHSA-j7qq-vr8c-xvw3 MLflow CrewAI autologging records LLM provider API keys in logged trace spans | Medium | Same weakness, CWE-312 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor