CVE-2012-6116: modules/certs/manifests/config.pp in katello-configure before 1.3.3.pulpv2 in Katello uses weak permissions...

Security readout for executives and security teams

Katello shipped a configuration file that made the Candlepin bootstrap RPM world-writable. A local user on the system could alter the Candlepin CA certificate stored through that RPM, weakening trust in certificate-based communication. The issue is local, not remotely exploitable from the supplied evidence. Exposure is most likely on older Katello installations using katello-configure versions before 1.3.3.pulpv2, especially where untrusted local users can access the host. Prioritize remediation for legacy Katello systems with shared or less-trusted local access. Business risk is trust-chain tampering, but urgency is reduced by the local access requirement and missing exploitation evidence. Mitigation focus: Upgrade katello-configure to 1.3.3.pulpv2 or later where applicable.; Apply relevant Red Hat advisories for affected Katello deployments.; Restrict local shell access on Katello hosts to trusted administrators..

Prepared

Jun 24, 2026, 11:46 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.