CVE-2013-4455 (published 2014-05-14T19:55Z)

Katello Installer before 0.0.18 uses world-readable permissions for /etc/pki/tls/private/katello-node.key when deploying a child Pulp node, which allows local users to obtain the private key by reading the file.

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:P/I:N/A:N)

Weakness information:
cwe_id: CWE-264
cwe_name: Permissions, Privileges, and Access Controls
description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Fix information:
repo_url: https://github.com/Katello/katello-installer
commit_details: repo_url: https://github.com/Katello/katello-installer
author: Ivan Necas
author_date: 2013-10-21 17:25:26+02:00
msg: 1021119 - make sure private keys are never world readable

This should prevent similar mistakes in future.
repository: repo_url: https://github.com/Katello/katello-installer
repo_name: Katello/katello-installer
description: Puppet-based installer for Katello
owner: Katello
file_changes: filename: certs.pp
change_type: ModificationType.MODIFY
diff: @@ -34,6 +34,11 @@ class apache::certs (
     privkey { $apache_ssl_key:
       ensure => present,
       cert => Cert["${::certs::node_fqdn}-ssl"]
+    } ->
+    file { $apache_ssl_key:
+      owner => $apache::params::user,
+      group => $apache::params::group,
+      mode  => '0400';
     }
 
     file { "${apache::params::configdir}/ssl.conf":

programming_language: Ruby
filename: katello_ssl_tool.rb
change_type: ModificationType.MODIFY
diff: @@ -175,7 +175,7 @@ module Puppet::Provider::KatelloSslTool
     end
 
     def create
-      File.open(resource[:path], "w") { |f| f << expected_content }
+      File.open(resource[:path], "w", mode) { |f| f << expected_content }
     end
 
     protected
@@ -198,6 +198,10 @@ module Puppet::Provider::KatelloSslTool
       raise NotImplementedError
     end
 
+    def mode
+      0644
+    end
+
     def cert_details
       return @cert_details if defined? @cert_details
       if cert_resource = @resource[:cert]

programming_language: Ruby
filename: katello_ssl_tool.rb
change_type: ModificationType.MODIFY
diff: @@ -8,4 +8,8 @@ Puppet::Type.type(:privkey).provide(:katello_ssl_tool, :parent => Puppet::Provid
     cert_details[:privkey]
   end
 
+  def mode
+    0400
+  end
+
 end

programming_language: Ruby
filename: foreman_certs.pp
change_type: ModificationType.MODIFY
diff: @@ -36,7 +36,7 @@ class kafo::foreman_certs (
 
     file { $client_key:
       owner => "foreman",
-      mode => "400"
+      mode => "0400"
     }
 
     pubkey { $client_ca:

programming_language: Perl
filename: foreman_proxy_certs.pp
change_type: ModificationType.MODIFY
diff: @@ -36,7 +36,7 @@ class kafo::foreman_proxy_certs (
 
     file { $proxy_key:
       owner => "foreman-proxy",
-      mode  => "400"
+      mode  => "0400"
     }
 
     pubkey { $proxy_ca:

programming_language: Perl
filename: puppet_certs.pp
change_type: ModificationType.MODIFY
diff: @@ -36,7 +36,7 @@ class kafo::puppet_certs (
 
     file { $client_key:
       owner => "puppet",
-      mode => "400"
+      mode => "0400"
     }
 
     pubkey { $client_ca:

programming_language: Ruby