Security readout for executives and security teams
Plain-English summary
Katello Installer before 0.0.18 could leave a child Pulp node private TLS key readable by any local user. If an untrusted user has shell access on the host, they may be able to copy that key, weakening trust in the node’s TLS identity.
Executive priority
Prioritize if legacy Katello child Pulp nodes exist or if shared administrative hosts allow local user access. For isolated, decommissioned, or single-admin systems, urgency is lower but validation is still warranted.
Technical view
The installer set world-readable permissions on /etc/pki/tls/private/katello-node.key during child Pulp node deployment. The documented impact is local private-key disclosure. The source bundle does not provide CVSS, CWE, affected CPEs, or evidence of remote exploitation.
Likely exposure
Exposure is likely limited to systems using Katello Installer versions before 0.0.18 to deploy child Pulp nodes, especially hosts with multiple local users or weak shell-access controls.
Exploitation context
The CVE describes local user access to a world-readable private key. KEV is false, and the provided sources do not cite active exploitation, public weaponization, or remote attack paths.
Researcher notes
The public record is sparse: no CVSS, CWE, CPE, or detailed advisory data is present in the provided bundle. The GitHub commit is the main fix indicator, and the described flaw is improper file permissions causing local key disclosure.
Mitigation direction
- Upgrade Katello Installer to 0.0.18 or later where applicable.
- Check Red Hat and Katello guidance for supported remediation details.
- Restrict permissions on the affected private key file.
- Rotate the exposed private key if it was world-readable.
- Review local user access on affected Pulp node hosts.
Validation and detection
- Identify Katello Installer versions used for child Pulp node deployment.
- Check whether /etc/pki/tls/private/katello-node.key exists on deployed nodes.
- Verify the key is not readable by non-privileged local users.
- Confirm any exposed key has been replaced after permission correction.
- Review host accounts for users with local shell access.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2013-4455 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://bugzilla.redhat.com/show_bug.cgi?id=1021784CVE reference · x_refsource_MISC
- https://github.com/Katello/katello-installer/commit/15e01086bcb3f5d42525730e8b162bca11bec85eCVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.