Project

General

Profile

Actions
Copy link

Bug #36760

closed

CVE-2023-4886: World readable tomcat server.xml contains passwords

Added by Ewoud Kohl van Wijngaarden 10 months ago. Updated 9 months ago.

Status:
Closed
Priority:
Normal
Assignee:
Ewoud Kohl van Wijngaarden
Category:
Foreman modules
Target version:
Foreman - 3.8.0
Difficulty:
Triaged:
No
Bugzilla link:
Pull request:
https://github.com/theforeman/puppet-candlepin/pull/242, https://github.com/theforeman/foreman-installer/pull/886, https://github.com/theforeman/foreman-installer/pull/887, https://github.com/theforeman/foreman-installer/pull/890
Fixed in Releases:
Foreman - 3.8.0
Found in Releases:
Red Hat JIRA:

Description

The file /etc/tomcat/server.xml contains passwords and is world readable. The actual keystore is limited by file permissions, but server.xml should also be limited.

Files

0001-Fixes-36760-Limit-access-to-server.xml.patch 0001-Fixes-36760-Limit-access-to-server.xml.patch 1.13 KB Ewoud Kohl van Wijngaarden, 09/20/2023 09:23 AM
0001-Refs-36760-Reset-candlepin-key-and-truststore.patch 0001-Refs-36760-Reset-candlepin-key-and-truststore.patch 2.24 KB Ewoud Kohl van Wijngaarden, 10/03/2023 03:38 PM
Actions
Copy link

Also available in: Atom PDF