CVE-2019-14825

katello: registry credentials are captured in plain text during repository discovery

Published Nov 25, 2019 CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed
Description
A cleartext password storage issue was discovered in Katello, versions 3.x.x.x before katello 3.12.0.9. Registry credentials used during container image discovery were inadvertently logged without being masked. This flaw could expose the registry credentials to other privileged users.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2022-4490 A cleartext password storage issue was discovered in Katello, versions 3.x.x.x before katello 3.12.0.9. Registry credentials used during container image discovery were inadvertently logged without being masked. This flaw could expose the registry credentials to other privileged users.
Github GHSA Github GHSA GHSA-m4wh-848j-9w2r Katello cleartext password storage issue
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Aug 5, 2024, 12:26 AM
Reserved
Aug 10, 2019, 12:00 AM
Status
Modified
Published
Nov 25, 2019, 4:15 PM
Modified
Jun 17, 2026, 2:19 AM
Severity
Low
Public date
Aug 9, 2019, 12:00 AM