Information Disclosure

spacewalk-backend is vulnerable to information disclosure. The vulnerability exists when a user submitted a system registration XML-RPC call to an RHN Satellite server (for example, by running “rhnreg_ks”) and that call failed, their RHN user password was included in plain text in the error messages both stored in the server log and mailed to the server administrator. With this update, user passwords are excluded from these error messages to avoid the exposure of authentication credentials.