candlepin vulnerabilities (Red Hat)
289 vulnerabilities.
candlepinRed HatA flaw was found in foreman before version 1.15 in the logging of adding and registering images....6.5 MediumcandlepinRed HatIn Pulp before version 2.16.2, secrets are passed into override_config when triggering a task and...5.5 MediumcandlepinRed HatIn Bouncy Castle JCE Provider the ECIES implementation allowed the use of ECB mode7.4 HighcandlepinRed HatIn Bouncy Castle JCE Provider the DHIES implementation allowed the use of ECB mode7.4 HighcandlepinRed HatThe Bouncy Castle JCE Provider carry a propagation bug7.5 HighcandlepinRed HatIn Bouncy Castle JCE Provider the other party DH public key is not fully validated3.7 LowcandlepinRed HatModerate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk155.9 MediumcandlepinRed HatIn Bouncy Castle JCE Provider the DSA key pair generator generates a weak private key if used with default values7.5 HighcandlepinRed HatIn Bouncy Castle JCE Provider ECDSA does not fully validate ASN.1 encoding of signature on verification7.5 HighcandlepinRed HatModerate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk155.9 MediumcandlepinRed HatModerate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk155.3 MediumcandlepinRed HatIn Bouncy Castle JCE Provider it is possible to inject extra elements in the sequence making up the signature and still have it validate7.5 HighcandlepinRed HatDenial of Service in Google Guava5.9 MediumcandlepinRed Hatforeman-debug before version 1.15.0 is vulnerable to a flaw in foreman-debug's logging. An...4.7 MediumcandlepinRed HatBouncy Castle BKS-V1 keystore files vulnerable to trivial hash collisions4.4 MediumcandlepinRed HatAn input sanitization flaw was found in the id field in the dashboard controller of Foreman...6.5 MediumcandlepinRed HatA flaw was found in foreman before 1.16.1. The issue allows users with limited permissions for...8.8 HighcandlepinRed Hathammer_cli_foreman Improper Certificate Validation vulnerability8.1 HighcandlepinRed Hatrack-protection gem timing attack vulnerability when validating CSRF token5.9 MediumcandlepinRed HatDjango Denial-of-service possibility in truncatechars_html and truncatewords_html template filters5.3 MediumcandlepinRed HatDjango denial-of-service possibility in urlize and urlizetrunc template filters5.3 MediumcandlepinRed HatA Denial of Service vulnerability was found in Apache Qpid Dispatch Router versions 0.7.0 and 0.8...6.5 MediumcandlepinRed HatIn previous versions of Puppet Agent it was possible for the agent to retrieve facts from an...6.5 MediumcandlepinRed HatDjango vulnerable to information leakage in AuthenticationForm7.5 HighcandlepinRed HatPrivilege Escalation in Hibernate Validator7.0 HighcandlepinRed HatTarball permission preservation in puppet5.5 MediumcandlepinRed Hatnet-ldap Improper Certificate Validation vulnerability5.9 MediumcandlepinRed HatAn attacker submitting facts to the Foreman server containing HTML can cause a stored XSS on...6.1 MediumcandlepinRed Hatjackson-databind vulnerable to deserialization flaw leading to unauthenticated remote code execution9.8 CriticalcandlepinRed HatPallets Werkzeug cross-site scripting vulnerability6.1 MediumcandlepinRed HatCross-site scripting (XSS) vulnerability in Foreman 1.7.0 and after.6.1 MediumcandlepinRed HatWithdrawn Advisory: Improper Restriction of XML External Entity Reference in Apache ActiveMQ9.8 CriticalcandlepinRed Hatdiscovery-debug in Foreman before 6.2 when the ssh service has been enabled on discovered nodes...7.0 HighcandlepinRed HatForeman after 1.1 and before 1.9.0-RC1 does not redirect HTTP requests to HTTPS when the...8.1 HighcandlepinRed HatPulp before 2.8.5 uses bash's $RANDOM in an unsafe way to generate passwords.7.5 HighcandlepinRed HatThe pulp-qpid-ssl-cfg script in Pulp before 2.8.5 allows local users to obtain the CA key.5.5 MediumcandlepinRed Hatclient/consumer/cli.py in Pulp before 2.8.3 writes consumer private keys to etc/pki/pulp/consumer...7.5 HighcandlepinRed Hatpulp.spec in the installation process for Pulp 2.8.3 generates the RSA key pairs used to validate...5.5 MediumcandlepinRed HatThe pulp-gen-nodes-certificate script in Pulp before 2.8.3 allows local users to leak the keys or...7.1 HighcandlepinRed HatThe Node certificate in Pulp before 2.8.3 contains the private key, and is stored in a world...5.5 MediumcandlepinRed HatVersions of Puppet prior to 4.10.1 will deserialize data off the wire (from the agent to the...8.2 HighcandlepinRed HatDjango open redirect and possible XSS attack via user-supplied numeric redirect URLs6.1 MediumcandlepinRed HatQOS.ch Logback vulnerable to Deserialization of Untrusted Data9.8 CriticalcandlepinRed HatDenial of service in JBoss resteasy7.5 HighcandlepinRed HatCross-site scripting (XSS) vulnerability in app/helpers/form_helper.rb in Foreman before 1.12.2,...6.1 MediumcandlepinRed HatForeman before 1.11.4 and 1.12.x before 1.12.1 does not properly restrict access to preview...5.3 MediumcandlepinRed HatThe (1) Organization and (2) Locations APIs in Foreman before 1.11.3 and 1.12.x before 1.12.0-RC1...5.0 MediumcandlepinRed HatForced Browsing in Twisted5.3 MediumcandlepinRed HatEval injection vulnerability in tftp_api.rb in the TFTP module in the Smart-Proxy in Foreman...8.8 HighcandlepinRed Hatsafemode gem allows context-dependent attackers to obtain sensitive information via the inspect method8.1 High- Show moreLoading…