RHEL 7 : Satellite 6.10.3 Async Bug Fix Update (Low) (RHSA-2022:0790)

medium Nessus Plugin ID 158745

Language:

Synopsis

The remote Red Hat host is missing a security update.

Description

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:0790 advisory.

Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity to provide public Internet access to their servers or other client systems. It performs provisioning and configuration management of predefined standard operating environments.

Security Fix(es):
2043714 - CVE-2021-4142 candlepin: Satellite: Allow unintended SCA certificate to authenticate Candlepin [rhn_satellite_6-default]

This update fixes the following bugs:

2043702 - Unable to sync EPEL repositories on Satellite 6.10 when 'Mirror on Sync' is enabled 2043710 - Syncing tens of repos to capsule can cause deadlock: while updating tuple (...) in relation core_content 2048306 - Satellite 6.10 may fail to sync content to capsule still in version 6.9 2049760 - No longer be able to import content into disconnected Satellite for existing content views 2053723 - Large repo sync failed with Katello::Errors::Pulp3Error: Response payload is not completed 2053726 - After upgrading to 6.10, Satellite fails to sync some repositories with large files with timeout error 2055660 - organization context fails to change in web UI 2055662 - Incremental CV update fails with 400 HTTP error 2027367 - Satellite doesn't forward the If-Modified-Since header for /accessible_content endpoint to Candlepin 2027786 - Satellite schedules one recurring InventorySync::Async::InventoryScheduledSync per org but each task syncs all orgs, resulting in harmless but unnecessary tasks 2043697 - null value in column manifest_id violates not-null constraint error while syncing RHOSP container images 2043698 - Remote Execution fails to honor remote_execution_connect_by_ip override on host 2043699 - Content view export failed with undefined method `first' for nil:NilClass 2043700 - webhook event build_exited never gets triggered 2043701 - Ansible roles are not starting automatically after provisioning 2043704 - Syncing sha-checksummed KS repository fails with: Artifact() got an unexpected keyword argument 'sha' 2043705 - db:seed can fail when there are host mismatches 2043706 - New OS created due to facts mismatch for operatingsystem for RHSM, Puppet and Ansible 2043707 - Satellite upgrade to 6.10.1 fails with multiple rubygem-sinatra package dependency errors 2043712 - pulpcore-workers grow very large when repositories have many changelog entries 2043715 - Limited CV docker tags cannot be pulled after syncing library repo with limit sync tags 2043716 - 406 error appears when running insights-client --compliance 2043719 - Incremental publish content view doesn't copy any contents 2043720 - ERROR: at least one Erratum record has migrated_pulp3_href NULL value 2047345 - New version of Candlepin now has org in entitlement certificate and causes authorization issues

Users of Red Hat Satellite are advised to upgrade to these updated packages, which fix these bugs.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected candlepin and / or candlepin-selinux packages.

Plugin Details

Severity: Medium

ID: 158745

File Name: redhat-RHSA-2022-0790.nasl

Version: 1.9

Type: local

Agent: unix

Family: Red Hat Local Security Checks

Published: 3/9/2022

Updated: 6/4/2024

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:N

CVSS Score Source: CVE-2021-4142

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:redhat:enterprise_linux:candlepin-selinux, p-cpe:/a:redhat:enterprise_linux:candlepin, cpe:/o:redhat:enterprise_linux:7

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Exploit Ease: No known exploits are available

Patch Publication Date: 3/8/2022

Vulnerability Publication Date: 3/8/2022

Reference Information

CVE: CVE-2021-4142

CWE: 287

RHSA: 2022:0790

Detections

Analytics