Description
Cumin (aka MRG Management Console), as used in Red Hat Enterprise MRG 2.5, uses the DES-based crypt function to hash passwords, which makes it easier for attackers to obtain sensitive information via a brute-force attack.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat MRG 2 | condor +8 | 7.8.10-0.1.el6 | RHSA-2014:0440 |
| Red Hat MRG 2 | cumin | 0.1.5796-2.el5_9 | RHSA-2014:0441, RHSA-2014:0440 |
| Red Hat MRG 2 | mongodb +1 | 1.6.4-7.el6 | RHSA-2014:0440 |
| Red Hat MRG 2 | mrg-release | 2.5.0-1.el5 | RHSA-2014:0441, RHSA-2014:0440 |
Advisories 2
- RHSA-2014:0440 Red Hat Security Advisory: Red Hat Enterprise MRG Grid 2.5 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2014:0441 Red Hat Security Advisory: Red Hat Enterprise MRG Messaging 2.5 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 28, 2026
References
- 1030158 vdb-entry
- RHSA-2014:0441 vendor-advisory
- RHSA-2014:0440 vendor-advisory