Description
Red Hat Network (RHN) Configuration Client (rhncfg-client) in rhncfg before 5.10.27-8 uses weak permissions (world-readable) for /var/log/rhncfg-actions, which allows local users to obtain sensitive information about the rhncfg-client actions by reading the file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Rhn Tools 6 | rhncfg +3 | 5.10.27-8.el6sat | RHSA-2012:1369 |
| Red Hat Rhel Rhn Tools 5 | rhncfg +3 | 5.10.27-8.el5sat | RHSA-2012:1369 |
Advisories 1
- RHSA-2012:1369 Red Hat Security Advisory: rhncfg security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- https://bugzilla.redhat.com/show_bug.cgi?id=825275
- 50978 third-party-advisory
- 55934 vdb-entry
- 1027661 vdb-entry
- netconfclient-rhncfgactions-info-disclosure(79260) vdb-entry
- RHSA-2012:1369 vendor-advisory