The installation script in Katello 1.0 and earlier does not properly generate the…
Priority MEDIUM 48CWE-798Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-798.
Summary
The installation script in Katello 1.0 and earlier does not properly generate the Application.config.secret_token value, which causes each default installation to have the same secret token, and allows remote attackers to authenticate to the CloudForms System Engine web interface as an arbitrary user by creating a cookie using the default secret_token.
Why it matters now
EPSS 0.03002 87th percentileScored 2026-11-07
Fix Fixed katello (RubyGems): 1.0.6, 1.1.7Red Hat: 2 advisories
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | katello (RubyGems) | before 1.0.6 | 1.0.6 | Patch available | GHSA-5xv2-q475-rwrh |
| — | katello (RubyGems) | 1.1.0 to before 1.1.7 | 1.1.7 | Patch available | GHSA-5xv2-q475-rwrh |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- katello (RubyGems) Vendor— Affected before 1.0.6 Fixed in 1.0.6 Patch available GHSA-5xv2-q475-rwrh
- katello (RubyGems) Vendor— Affected 1.1.0 to before 1.1.7 Fixed in 1.1.7 Patch available GHSA-5xv2-q475-rwrh
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:theforeman:katello:*:*:*:*:*:*:*:* | up to 1.0 | Vulnerable | The Foreman Project |
| cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | Red Hat |
- cpe:2.3:a:theforeman:katello:*:*:*:*:*:*:*:* Versions up to 1.0 Vulnerable ·The Foreman Project
- cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
Remediation
- Fix · GHSA-5xv2-q475-rwrh katello (RubyGems) Fixed in 1.0.6 Advisory →
- Fix · GHSA-5xv2-q475-rwrh katello (RubyGems) Fixed in 1.1.7 Advisory →
Red Hat 2 advisories
- RHSA-2012:1187 Released 2012-08-21 · Red Hat rating Importantkatello security update
- Red Hat Subscription Asset Manager for RHEL 6 Server katello-0.3.4-1.el6_2, katello-common-0.3.4-1.el6_2, katello-glue-candlepin-0.3.4-1.el6_2
- RHSA-2012:1186 Released 2012-08-21 · Red Hat rating Importantkatello security update
- CloudForms System Engine for RHEL 6 Server katello-0.1.320-1.el6cf, katello-all-0.1.320-1.el6cf, katello-common-0.1.320-1.el6cf +3
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| CloudForms System Engine for RHEL 6 Server | Fixed | RHSA-2012:1186 |
| Red Hat Subscription Asset Manager for RHEL 6 Server | Fixed | RHSA-2012:1187 |
Timeline
- 2026-10-02 Threatist record created from CVE-2012-3503
- 2026-10-03 Alias added: GHSA-5xv2-q475-rwrh
References
Advisory 4
Other 5
- https://github.com/Katello/katello/pull/499
- https://github.com/Katello/katello
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/katello/CVE-2012-3503.yml
- https://web.archive.org/web/20140806122239/http://secunia.com/advisories/50344
- https://web.archive.org/web/20200229120740/http://www.securityfocus.com/bid/55140
Sources
- CVE-2012-3503 · CVE Program
- CVE-2012-3503 · NVD
- FIRST EPSS
- GHSA-5xv2-q475-rwrh · GitHub Advisory Database · CC BY 4.0
- CVE-2012-3503 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences