Description
A flaw was found in Spacewalk-backend. This information disclosure vulnerability occurs when a system registration XML-RPC call fails, causing cleartext user passwords to be included in error messages. Remote administrators can exploit this by reading server logs and emails, leading to the unauthorized disclosure of user passwords.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Network Proxy v 5.4 | — | — |
| Red Hat | Red Hat Network Satellite Server v 5.4 | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Network Satellite 5 | spacewalk-backend +17 | 1.2.13-66.el5sat | RHSA-2012:0101 |
| Red Hat Network Proxy 5 | spacewalk-backend +1 | 1.2.13-66.el5sat | RHSA-2012:0102 |
Advisories 2
- RHSA-2012:0102 Red Hat Security Advisory: Red Hat Network Proxy spacewalk-backend security and bug fix update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2012:0101 Red Hat Security Advisory: Red Hat Network Satellite spacewalk-backend security and bug fix update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- http://rhn.redhat.com/errata/RHSA-2012-0101.html
- http://rhn.redhat.com/errata/RHSA-2012-0102.html
- RHSA-2012:0101 vendor-advisory
- RHSA-2012:0102 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2012-0059 vdb-entry