Skip to content
Fencer Intel
medium 4.9

CVE-2012-0059 json

Spacewalk-backend: spacewalk-backend: information disclosure via cleartext passwords in error messages

published 2014-02-05 12 y ago modified 2026-11-05 4 d ago also EUVD-2012-0097

cvss
4.9
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.7%
EPSS 1.7% chance of exploitation in 30 days, percentile 76%
public exploits
0
none known

Summary

A flaw was found in Spacewalk-backend. This information disclosure vulnerability occurs when a system registration XML-RPC call fails, causing cleartext user passwords to be included in error messages. Remote administrators can exploit this by reading server logs and emails, leading to the unauthorized disclosure of user passwords.

Patch / fix

  • Red Hat Red Hat Network Proxy v 5.4 0:1.2.13-66.el5sat
  • Red Hat Red Hat Network Satellite Server v 5.4 0:1.2.13-66.el5sat
  • spacewalk-backend network satellite 5.4, network proxy 5.4 1.2.13-66.el5sat
  • spacewalk-backend network satellite 5.4, network proxy 5.4 1.2.13-66.el6sat
  • spacewalk-backend-libs network satellite 5.4, network proxy 5.4 1.2.13-66.el5sat
  • spacewalk-backend-libs network satellite 5.4, network proxy 5.4 1.2.13-66.el6sat
  • spacewalk-backend-xp network satellite 5.4 1.2.13-66.el5sat
  • spacewalk-backend-xp network satellite 5.4 1.2.13-66.el6sat
  • spacewalk-backend-app network satellite 5.4 1.2.13-66.el5sat
  • spacewalk-backend-app network satellite 5.4 1.2.13-66.el6sat

red hat advisories RHSA-2012:0102RHSA-2012:0101

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2012-0059 updated cvss 4.9

Spacewalk-backend: Spacewalk-backend: Information Disclosure via cleartext passwords in error messages

  • Red Hat Enterprise Linux 6 rhnsd, rhn-check, rhn-setup, yum-rhn-plugin, rhn-setup-gnome, rhn-client-tools Red Hat Enterprise Linux 7 rhnsd, yum-rhn-plugin
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Satellite 5.4 (RHEL v.5) spacewalk-backend 1.2.13-66.el5sat, spacewalk-backend-xp 1.2.13-66.el5sat, spacewalk-backend-app 1.2.13-66.el5sat, spacewalk-backend-iss 1.2.13-66.el5sat, spacewalk-backend-sql 1.2.13-66.el5sat, spacewalk-backend-libs 1.2.13-66.el5sat, +12 more Red Hat Satellite 5.4 (RHEL v.6) spacewalk-backend 1.2.13-66.el6sat, spacewalk-backend-xp 1.2.13-66.el6sat, spacewalk-backend-app 1.2.13-66.el6sat, spacewalk-backend-iss 1.2.13-66.el6sat, spacewalk-backend-sql 1.2.13-66.el6sat, spacewalk-backend-libs 1.2.13-66.el6sat, +12 more
    fixed: vendor fix RHSA-2012:0101
  • Red Hat Satellite Proxy 5.4 (RHEL v.5) spacewalk-backend 1.2.13-66.el5sat, spacewalk-backend-libs 1.2.13-66.el5sat Red Hat Satellite Proxy 5.4 (RHEL v.6) spacewalk-backend 1.2.13-66.el6sat, spacewalk-backend-libs 1.2.13-66.el6sat
    fixed: vendor fix RHSA-2012:0102

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.67% chance of exploitation in the next 30 days, higher than 76% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N

Affected products

  • Red Hat Red Hat Network Proxy v 5.4
  • Red Hat Red Hat Network Satellite Server v 5.4
  • Red Hat Red Hat Enterprise Linux 6
  • Red Hat Red Hat Enterprise Linux 7

Classification

Weakness
  • CWE-209 Generation of Error Message Containing Sensitive Information
  • CWE-310 Cryptographic Issues

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.