CVE:CVE-2013-4455
CNNVD:CNNVD-201405-269
Katello是一款系统管理引擎，它可提供配置管理、订阅管理和内容管理的工作流。Katello Installer是一个用于配置Katello节点的工具。
Katello Installer 0.0.17及之前的版本中存在安全漏洞，该漏洞源于程序对/etc/pki/tls/private/katello-node.key文件使用全局可读权限。本地攻击者可通过读取此文件利用该漏洞获取私钥。
solution:Upgrade katello katello_installer to a higher version than 0.0.17,0.0.1,0.0.2,0.0.3,0.0.4,0.0.5,0.0.6,0.0.7,0.0.8,0.0.9,0.0.10,0.0.11,0.0.12,0.0.13,0.0.14,0.0.15,0.0.16,and avoid the version (,0.0.17],0.0.1,0.0.2,0.0.3,0.0.4,0.0.5,0.0.6,0.0.7,0.0.8,0.0.9,0.0.10,0.0.11,0.0.12,0.0.13,0.0.14,0.0.15,0.0.16