Threats tagged 'ghsa-gp59-h6j7-4p3h'

A local information disclosure vulnerability exists in cockpit-machines on Red Hat Enterprise Linux 10. The flaw exposes a sensitive Red Hat Subscription Management (RHSM) offline token via process command-line arguments during token validation. An attacker with local access and the ability to inspect process metadata can disclose this token, potentially compromising confidentiality. The vulnerability requires low privileges but user interaction and local access. Mitigations include restricting /proc visibility and avoiding token validation on multi-user systems until a fixed package is installed.