What’s Vulnerable › Vulnerabilities

CVE-2012-6119

• Severity: low (CVSS 2.1 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2013-04-02 · updated 2026-06-16
• Weakness: CWE-264

Description

Candlepin before 0.7.24, as used in Red Hat Subscription Asset Manager before 1.2.1, does not properly check manifest signatures, which allows local users to modify manifests.

Affected products

• candlepin: through 0.7.2; 0.4.5, 0.4.11, 0.4.27, 0.5.5, 0.6.3
• RedHat Subscription Asset Manager: through 1.2.0; 1.0.0, 1.1.0

References

• http://rhn.redhat.com/errata/RHSA-2013-0686.html
• http://secunia.com/advisories/52774
• http://www.osvdb.org/91719
• https://bugzilla.redhat.com/show_bug.cgi?id=908613
• https://github.com/candlepin/candlepin/blob/master/candlepin.spec
• https://github.com/candlepin/candlepin/commit/f4d93230e58b969c506b4c9778e04482a059b08c
• http://rhn.redhat.com/errata/RHSA-2013-0686.html
• http://secunia.com/advisories/52774
• http://www.osvdb.org/91719
• https://bugzilla.redhat.com/show_bug.cgi?id=908613
• https://github.com/candlepin/candlepin/blob/master/candlepin.spec
• https://github.com/candlepin/candlepin/commit/f4d93230e58b969c506b4c9778e04482a059b08c

Get alerted when CVE-2012-6119 or the next vulnerability affects your stack