GHSA-GF89-385C-HQ37 vulnerabilities

Vulnerabilities for packages: py3-pulp...

GHSA-9M5J-4XX9-44J9 vulnerabilities

Vulnerabilities for packages: py3-pulp...

EUVD-2024-2549

Malicious code in bioql PyPI...

pulpcore: RBAC permissions incorrectly assigned in tasks that create objects

A flaw was found in the Pulp package. When a role-based access control RBAC object in Pulp is set to assign permissions on its creation, it uses the AutoAddObjPermsMixin typically the addrolesforobjectcreator method. This method finds the object creator by checking the current authenticated user...

galaxy-ng (>=4.2.0a3 <=4.9.2), pulp-2to3-migration (>=0.0.1b1 <=0.17.0) +16 more potentially affected by CVE-2024-7143 via pulpcore (>=3.0.1 <=3.54.1)

pulpcore PYPI version =3.0.1, =4.2.0a3, =0.0.1b1, =0.2.0b6, =0.1.0rc4, =1.0.0, =0.1.0b4, =2.0.0b3, =0.1.0, =0.1.0, =0.1.0, =0.1.0a1.dev0, =2.0.0, =3.0.0, =3.0.0, =3.36.0 and more Source cves: CVE-2024-7143 Source advisory: OSV:GHSA-9M5J-4XX9-44J9...

CVE-2024-7143

A flaw was found in the Pulp package. When a role-based access control RBAC object in Pulp is set to assign permissions on its creation, it uses the AutoAddObjPermsMixin typically the addrolesforobjectcreator method. This method finds the object creator by checking the current authenticated user...

CVE-2024-7143 Pulpcore: rbac permissions incorrectly assigned in tasks that create objects

A flaw was found in the Pulp package. When a role-based access control RBAC object in Pulp is set to assign permissions on its creation, it uses the AutoAddObjPermsMixin typically the addrolesforobjectcreator method. This method finds the object creator by checking the current authenticated user...

CVE-2024-7143

CVE-2024-7143 – Affected: Pulp RBAC object creation using AutoAddObjPermsMixin; root cause is that the system determines the object creator from the current authenticated user, which on tasks is inherited from the oldest user with task permissions. As a result, permissions on objects created with...

Fedora Update for pulp FEDORA-2016-4373f7d32a

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...