Pulp before 2.8.5 uses bash's $RANDOM in an unsafe way to generate passwords.
Pulp before 2.8.5 uses bash's $RANDOM in an unsafe way to generate passwords.
Weaknesses in this category are related to the management of credentials.
https://cwe.mitre.org/data/definitions/255.html →Open in CWE collection →The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
https://cwe.mitre.org/data/definitions/330.html →Open in CWE collection →This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.
https://capec.mitre.org/data/definitions/59.html →Open in CAPEC collection →In this attack, some asset (information, functionality, identity, etc.) is protected by a finite secret value. The attacker attempts to gain access to this asset by using trial-and-error to exhaustively explore all the possible secret values in the hope of finding the secret (or a value that is functionally equivalent) that will unlock the asset.
https://capec.mitre.org/data/definitions/112.html →Open in CAPEC collection →An attacker obtains an authoritative or reputable signer's private signature key by exploiting a cryptographic weakness in the signature algorithm or pseudorandom number generation and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.
https://capec.mitre.org/data/definitions/485.html →Open in CAPEC collection →| Product | Vendor | Status |
|---|---|---|
| candlepin | Tracked | |
| candlepin | Tracked | |
| foreman | Tracked | |
| foreman | Tracked | |
| foreman-bootloaders-redhat | Tracked | |
| foreman-bootloaders-redhat | Tracked | |
| foreman-discovery-image | Tracked | |
| foreman-discovery-image | Tracked | |
| foreman-installer | Tracked | |
| foreman-installer | Tracked | |
| foreman-proxy | Tracked | |
| foreman-proxy | Tracked | |
| foreman-selinux | Tracked | |
| foreman-selinux | Tracked | |
| hiera | Tracked | |
| hiera | Tracked | |
| katello | Tracked | |
| katello | Tracked | |
| katello-certs-tools | Tracked | |
| katello-certs-tools | Tracked |