Red Hat Security Advisory 2012-1187-01 - Katello allows you to manage the application life-cycle for Linux systems. Katello is used by Red Hat Subscription Asset Manager, a distributor application for handling subscription information and software updates on client machines. It was found that the katello-common package's installation script did not correctly generate the secret token used for session cookie generation, leading to every default installation using the same secret token. A remote attacker could use this flaw to create a cookie that would allow them to log into the Subscription Asset Manager web interface as any user, without knowing the passwords.
597c317d6628bef13dbbc7a4fc8d6af89eed7367a7de44c2f866d8f5fa21e962