---
id: CVE-2012-5605
title: >-
  Grinder: red hat cloudforms: grinder in red hat cloudforms: local users can
  modify cache files via world-writable permissions
summary: >-
  A flaw was found in Grinder, a component of Red Hat CloudForms. This
  vulnerability allows a local user to modify Grinder's cache files due to
  incorrect world-writable permissions set on the `/var/lib/pulp/cache/grinder/`
  directory. This …
severity: low
cvss: 3.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-276
vendor: Red Hat
product: candlepin
affected:
  - candlepin (all versions)
  - gofer (all versions)
  - grinder (all versions)
  - katello (all versions)
  - katello-agent (all versions)
  - katello-certs-tools (all versions)
  - katello-cli (all versions)
  - katello-cli-tests (all versions)
  - katello-configure (all versions)
  - katello-selinux (all versions)
  - pulp (all versions)
  - quartz (all versions)
  - rubygem-apipie-rails (all versions)
  - gofer (all versions)
  - katello-agent (all versions)
published: '2013-01-04'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T18:52:20.667Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2012-5605'
references:
  - url: 'http://osvdb.org/88141'
  - url: 'http://rhn.redhat.com/errata/RHSA-2012-1543.html'
  - url: 'http://secunia.com/advisories/51472'
  - url: 'http://www.securityfocus.com/bid/56819'
  - url: 'https://access.redhat.com/errata/RHSA-2012:1543'
    label: 'RHSA-2012:1543'
  - url: 'https://access.redhat.com/security/cve/CVE-2012-5605'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=828447'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=882138'
  - url: 'https://exchange.xforce.ibmcloud.com/vulnerabilities/80550'
tags:
  - cve.org
epss: 0.00321
epssPercentile: 0.25277
ingestedAt: '2026-11-05T16:24:31.394Z'
---

## Overview

A flaw was found in Grinder, a component of Red Hat CloudForms. This vulnerability allows a local user to modify Grinder's cache files due to incorrect world-writable permissions set on the `/var/lib/pulp/cache/grinder/` directory. This could lead to unauthorized data tampering within the application's cache.

## Affected

- `candlepin (all versions)`
- `gofer (all versions)`
- `grinder (all versions)`
- `katello (all versions)`
- `katello-agent (all versions)`
- `katello-certs-tools (all versions)`
- `katello-cli (all versions)`
- `katello-cli-tests (all versions)`
- `katello-configure (all versions)`
- `katello-selinux (all versions)`
- `pulp (all versions)`
- `quartz (all versions)`
- `rubygem-apipie-rails (all versions)`
- `gofer (all versions)`
- `katello-agent (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.