Description
rhn-migrate-classic-to-rhsm tool in Red Hat subscription-manager does not verify the Red Hat Network Classic server's X.509 certificate when migrating to a Certificate-based Red Hat Network, which allows remote man-in-the-middle attackers to obtain sensitive information such as user credentials.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | subscription-manager +3 | 1.1.23.1-1.el6_4 | RHSA-2013:0788 |
| RHEL 5 | subscription-manager +3 | 1.0.24.1-1.el5_9 | RHSA-2013:0788 |
Advisories 1
- RHSA-2013:0788 Red Hat Security Advisory: subscription-manager security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- 59674 vdb-entry
- 93058 vdb-entry
- 1028520 vdb-entry
- 53330 third-party-advisory
- redhat-ssl-cve20126137-sec-bypass(84020) vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=885130
- RHSA-2013:0788 vendor-advisory