CVE-2012-6137
Fixed in a distro release EPSS <1%
rhn-migrate-classic-to-rhsm tool in Red Hat subscription-manager does not verify the Red Hat Network Classic server's X.509 certificate when migrating to a Certificate-based Red Hat Network, which allows remote man-in-the-middle attackers to obtain sensitive information such as user credentials.
Products: redhat enterprise_linux, redhat enterprise_linux_desktop, redhat enterprise_linux_eus, redhat enterprise_linux_hpc_node, redhat enterprise_linux_long_life, redhat enterprise_linux_server, redhat enterprise_linux_server_aus, redhat enterprise_linux_server_eus, redhat enterprise_linux_workstation
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat Enterprise Linux 5 | subscription-manager | 0:1.0.24.1-1.el5_9 |
| Red Hat Enterprise Linux 5 | subscription-manager-debuginfo | 0:1.0.24.1-1.el5_9 |
| Red Hat Enterprise Linux 5 | subscription-manager-firstboot | 0:1.0.24.1-1.el5_9 |
| Red Hat Enterprise Linux 5 | subscription-manager-gui | 0:1.0.24.1-1.el5_9 |
| Red Hat Enterprise Linux 5 | subscription-manager-migration | 0:1.0.24.1-1.el5_9 |
| Red Hat Enterprise Linux 6 | subscription-manager | 0:1.1.23.1-1.el6_4 |
| Red Hat Enterprise Linux 6 | subscription-manager-debuginfo | 0:1.1.23.1-1.el6_4 |
| Red Hat Enterprise Linux 6 | subscription-manager-firstboot | 0:1.1.23.1-1.el6_4 |
| Red Hat Enterprise Linux 6 | subscription-manager-gui | 0:1.1.23.1-1.el6_4 |
| Red Hat Enterprise Linux 6 | subscription-manager-migration | 0:1.1.23.1-1.el6_4 |