Bugzilla – Bug 850953
VUL-1: CVE-2012-5562: spacewalk: rhn-proxy: may transmit credentials over clear-text
Last modified: 2014-03-12 12:56:17 UTC
was only released in satellite 5.6
It was found that when RHN Proxy was used as a proxy to connect to RHN Satellite, certain pages that should have been protected via SSL (in direct to Satellite connections) were in fact only protected between RHN Proxy and RHN Satellite; the connection between the client and RHN Proxy was not protected via SSL. This could leak confidential information or authentication credentials when accessing RHN Satellite via RHN Proxy.
By default, yum clients and rhn_register will always communicate with RHN Proxy over HTTPS.