CVE-2016-4996

19

FAUCET Score

CVE-2016-4996 describes a vulnerability in Foreman before version 6.2, specifically affecting the discovery-debug component when the SSH service is enabled on discovered nodes. This flaw causes the root password to be displayed in plaintext within the system journal during login, impacting Red Hat Enterprise Linux Server and Red Hat Satellite. Rated with a CVSS v3 score of 7.0 (High), this vulnerability has a local attack vector with high attack complexity, allowing authenticated local users to obtain the root password by accessing the system journal or console logs, leading to high confidentiality, integrity, and availability impacts. There is no evidence of active exploitation, nor are there any known public exploit codes available in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, indicating a low level of public attention.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		6.3CPE matchmatch criteria	cpe:2.3:a:redhat:satellite:6.3:::::::*

CVSS Data

CVSS version used by this source: 3.0

7.0HIGH

CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

Exploitability Score

1.0

Impact Score

5.9

CvssVersion

3.0

Exploit Intelligence

EPSS Score

0.31%

Probability of exploitation in next 30 days

EPSS Percentile

23.1%

Percentile rank of EPSS score among Peer Group

As of 2026-07-26

Model: v2026.06.15

This CVE's current EPSS score of 0.0031 is in the 59th percentile among its peer group of 1,516 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.4 InfoSec Media, 0.1 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (67)

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: candlepin-0:2.1.14-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: foreman-0:1.15.6.34-1.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: foreman-bootloaders-redhat-0:201801241201-2.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: foreman-discovery-image-0:3.4.4-1

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: foreman-installer-1:1.15.6.8-1.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: foreman-proxy-0:1.15.6.4-1.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: foreman-selinux-0:1.15.6.2-1.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: hiera-0:1.3.1-2.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: katello-0:3.4.5-15.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: katello-certs-tools-0:2.4.0-1.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: katello-client-bootstrap-0:1.5.1-1.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: katello-installer-base-0:3.4.5.26-1.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: katello-selinux-0:3.0.2-1.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: kobo-0:0.5.1-1.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: pulp-0:2.13.4.6-1.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: pulp-docker-0:2.4.1-2.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: pulp-katello-0:1.0.2-1.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: pulp-ostree-0:1.2.1.1-1.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: pulp-puppet-0:2.13.4-3.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: pulp-rpm-0:2.13.4.8-1.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: puppet-foreman_scap_client-0:0.3.16-1.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: python-zope-interface-0:4.0.5-4.el7

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: redhat-access-insights-puppet-0:0.0.9-2.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: rubygem-foreman_scap_client-0:0.3.0-2.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: rubygem-kafo-0:2.0.2-1.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: rubygem-kafo_parsers-0:0.1.6-1.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: rubygem-kafo_wizards-0:0.0.1-2.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: rubygem-smart_proxy_dhcp_remote_isc-0:0.0.2.1-1.fm1_15.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: rubygem-smart_proxy_discovery-0:1.0.4-3.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: rubygem-smart_proxy_discovery_image-0:1.0.9-1.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: rubygem-smart_proxy_dynflow-0:0.1.10-1.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: rubygem-smart_proxy_openscap-0:0.6.9-1.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: rubygem-smart_proxy_pulp-0:1.3.0-1.git.0.b5c2768.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: rubygem-smart_proxy_remote_execution_ssh-0:0.1.6-1.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: rubygem-tilt-0:1.3.7-2.git.0.3b416c9.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: satellite-0:6.3.0-23.0.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: satellite-installer-0:6.3.0.12-1.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: tfm-rubygem-bastion-0:5.1.1.4-1.fm1_15.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: tfm-rubygem-foreman_bootdisk-0:10.0.2.2-1.fm1_15.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: tfm-rubygem-foreman_discovery-0:9.1.5.3-1.fm1_15.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: tfm-rubygem-foreman_docker-0:3.1.0.3-1.fm1_15.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: tfm-rubygem-foreman_hooks-0:0.3.14-1.fm1_15.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: tfm-rubygem-foreman_openscap-0:0.7.11-1.fm1_15.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: tfm-rubygem-foreman-redhat_access-0:2.0.13-1.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: tfm-rubygem-foreman_remote_execution-0:1.3.7.2-1.fm1_15.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: tfm-rubygem-foreman_remote_execution_core-0:1.0.6-1.fm1_15.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: tfm-rubygem-foreman-tasks-0:0.9.6.4-1.fm1_15.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: tfm-rubygem-foreman-tasks-core-0:0.1.8-1.fm1_15.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: tfm-rubygem-foreman_templates-0:5.0.1-1.fm1_15.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: tfm-rubygem-foreman_theme_satellite-0:1.0.4.16-1.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: tfm-rubygem-foreman_virt_who_configure-0:0.1.9-1.fm1_15.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: tfm-rubygem-hammer_cli-0:0.11.0.1-1.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: tfm-rubygem-hammer_cli_csv-0:2.3.0-1.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: tfm-rubygem-hammer_cli_foreman-0:0.11.0.5-1.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: tfm-rubygem-hammer_cli_foreman_admin-0:0.0.8-1.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: tfm-rubygem-hammer_cli_foreman_bootdisk-0:0.1.3.3-2.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: tfm-rubygem-hammer_cli_foreman_discovery-0:1.0.0-1.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: tfm-rubygem-hammer_cli_foreman_docker-0:0.0.6-2.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: tfm-rubygem-hammer_cli_foreman_openscap-0:0.1.5-1.fm1_15.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: tfm-rubygem-hammer_cli_foreman_remote_execution-0:0.0.6-1.fm1_15.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: tfm-rubygem-hammer_cli_foreman_tasks-0:0.0.12-1.fm1_15.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: tfm-rubygem-hammer_cli_foreman_virt_who_configure-0:0.0.3-1.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: tfm-rubygem-hammer_cli_katello-0:0.11.3.5-1.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: tfm-rubygem-katello-0:3.4.5.58-1.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: tfm-rubygem-ovirt_provision_plugin-0:1.0.2-1.fm1_15.el7sat

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.3 for RHEL 7Fixed in: tfm-rubygem-smart_proxy_dynflow_core-0:0.1.10-1.fm1_15.el7sat

redhatend of lifevia redhat_api

Product: Red Hat Ceph Storage 1.3Fixed in: foreman

Vendor Advisories (1)

redhatCVE-2016-4996Moderate

foreman: inside discovery-debug, the root password is displayed in plaintext

References

access.redhat.com / errata/RHSA-2018:0336

Third Party Advisory

bugzilla.redhat.com / show_bug.cgi

Issue TrackingThird Party Advisory