Description
A flaw was found where the Plaintext Candlepin password is disclosed while updating Red Hat Satellite through the satellite-installer. This flaw allows an attacker with sufficiently high privileges, such as root, to retrieve the Candlepin plaintext password.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | foreman-installer | foreman-installer 1.24.1.22 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite Capsule 6 | ansiblerole-satellite-receptor-installer | 0.6.6.1-1.el7sat | RHBA-2020:3614 |
| Red Hat Satellite Capsule 6 | foreman +1 | 1.24.1.25-1.el7sat | RHBA-2020:3614 |
| Red Hat Satellite Capsule 6 | foreman-installer +1 | 1:1.24.1.22-1.el7sat | RHBA-2020:3614 |
| Red Hat Satellite Capsule 6 | pulp +14 | 2.21.0.2-1.el7sat | RHBA-2020:3614 |
| Red Hat Satellite Capsule 6 | satellite +3 | 6.7.3-1.el7sat | RHBA-2020:3614 |
| Red Hat Satellite 6 | ansiblerole-satellite-receptor-installer | 0.6.6.1-1.el7sat | RHBA-2020:3614 |
| Red Hat Satellite 6 | foreman +12 | 1.24.1.25-1.el7sat | RHBA-2020:3614 |
| Red Hat Satellite 6 | foreman-installer +1 | 1:1.24.1.22-1.el7sat | RHBA-2020:3614 |
| Red Hat Satellite 6 | pulp +10 | 2.21.0.2-1.el7sat | RHBA-2020:3614 |
| Red Hat Satellite 6 | python-receptor-satellite +1 | 1.0.1-2.el7sat | RHBA-2020:3614 |
| Red Hat Satellite 6 | satellite +4 | 6.7.3-1.el7sat | RHBA-2020:3614 |
| Red Hat Satellite 6 | tfm-rubygem-foreman-tasks | 0.17.5.7-1.el7sat | RHBA-2020:3614 |
| Red Hat Satellite 6 | tfm-rubygem-foreman_ansible | 4.0.3.7-1.el7sat | RHBA-2020:3614 |
| Red Hat Satellite 6 | tfm-rubygem-foreman_remote_execution +1 | 2.0.10.2-1.el7sat | RHBA-2020:3614 |
| Red Hat Satellite 6 | tfm-rubygem-katello | 3.14.0.27-1.el7sat | RHBA-2020:3614 |
Advisories 1
- RHBA-2020:3614 Red Hat Bug Fix Advisory: Satellite 6.7.3 Async Bug Fix Update Red Hat Security Advisories (RHSA) · Jun 27, 2026