In short
- CVE-2019-14825 is a LOW (CVSS 2.7) vulnerability affecting katello, katello (theforeman).
- Chance of exploitation in the next 30 days (EPSS): 0.65%, higher than 51.3% of all vulnerabilities.
- Fix: update to 3.12.2, 3.12.0.9 or later.
| Package | Affected versions | Patched versions |
|---|
| katello RubyGems | ≥ 3.0.0.0, < 3.12.2
| 3.12.2
|
| katello | ≥ 3.0.0.0, < 3.12.0.9
| 3.12.0.9
|
Description
A cleartext password storage issue was discovered in Katello, versions 3.x.x.x before katello 3.12.2. Registry credentials used during container image discovery were inadvertently logged without being masked. This flaw could expose the registry credentials to other privileged users.
NVD description
A cleartext password storage issue was discovered in Katello, versions 3.x.x.x before katello 3.12.0.9. Registry credentials used during container image discovery were inadvertently logged without being masked. This flaw could expose the registry credentials to other privileged users.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free