CVE-2019-3891
Last modified
CVE-2019-3891 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. It was discovered that a world-readable log file belonging to Candlepin component of Red Hat Satellite 6.4 leaked the credentials of the Candlepin database. A malicious user with local access to a Satellite host can use those credentials to modify the database and prevent Satellite from fetching package updates, thus preventing all Satellite hosts from accessing those updates.. EPSS estimates a 0.68% chance of exploitation in the next 30 days.
Description
It was discovered that a world-readable log file belonging to Candlepin component of Red Hat Satellite 6.4 leaked the credentials of the Candlepin database. A malicious user with local access to a Satellite host can use those credentials to modify the database and prevent Satellite from fetching package updates, thus preventing all Satellite hosts from accessing those updates.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Redhat | Satellite | 6.4 |
References
- https://access.redhat.com/errata/RHSA-2019:1222Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3891Exploit, Issue Tracking, Mitigation, Vendor Advisory
- https://access.redhat.com/errata/RHSA-2019:1222Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3891Exploit, Issue Tracking, Mitigation, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-3891?
How severe is CVE-2019-3891?
How do I fix CVE-2019-3891?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-3885A use-after-free flaw was found in pacemaker up to and inclu…3.3
- CVE-2019-3886An incorrect permissions check was discovered in libvirt 4.8…5.4
- CVE-2019-3887A flaw was found in the way KVM hypervisor handled x2APIC Ma…5.6
- CVE-2019-3888A vulnerability was found in Undertow web server before 2.0.…9.8
- CVE-2019-3889A reflected XSS vulnerability exists in authorization flow o…5.4
- CVE-2019-3890It was discovered evolution-ews before 3.31.3 does not check…8.1
- CVE-2019-3892Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2019-3893In Foreman it was discovered that the delete compute resourc…4.9
- CVE-2019-3894It was discovered that the ElytronManagedThread in Wildfly's…8.8
- CVE-2019-3895An access-control flaw was found in the Octavia service when…8
- CVE-2019-3896A double-free can happen in idr_remove_all() in lib/idr.c in…7
- CVE-2019-3897It has been discovered in redhat-certification that any unau…5.3
Are you affected by CVE-2019-3891?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST