15 matches found
CVE-2026-103870
A flaw was found in pulp-rpm when it publishes a distribution tree. Addon and variant ids from .treeinfo are used as directory names. A user who can sync or upload that tree can make the publish task create a new directory outside the task work area and write that tree's repository metadata and...
CVE-2026-103870 Pulp-rpm: distribution tree publish creates directories from .treeinfo ids
A flaw was found in pulp-rpm when it publishes a distribution tree. Addon and variant ids from .treeinfo are used as directory names. A user who can sync or upload that tree can make the publish task create a new directory outside the task work area and write that tree's repository metadata and...
CVE-2026-103870 Pulp-rpm: distribution tree publish creates directories from .treeinfo ids
A flaw was found in pulp-rpm when it publishes a distribution tree. Addon and variant ids from .treeinfo are used as directory names. A user who can sync or upload that tree can make the publish task create a new directory outside the task work area and write that tree's repository metadata and...
CVE-2026-103870
A path traversal flaw exists in pulp-rpm during the distribution tree publication process. The software uses addon and variant IDs from .treeinfo files as directory names without sufficient validation. An attacker with permissions to sync or upload a distribution tree can force the publish task t...
EUVD-2026-94172
A flaw was found in pulp-rpm when it publishes a distribution tree. Addon and variant ids from .treeinfo are used as directory names. A user who can sync or upload that tree can make the publish task create a new directory outside the task work area and write that tree's repository metadata and...
CVE-2026-103870
A flaw was found in pulp-rpm when it publishes a distribution tree. Addon and variant ids from .treeinfo are used as directory names. A user who can sync or upload that tree can make the publish task create a new directory outside the task work area and write that tree's repository metadata and...
CVE-2026-103870: Improper Limitation of a Pathname to a Restricted Directory
A flaw was found in pulp-rpm when it publishes a distribution tree. Addon and variant ids from .treeinfo are used as directory names. A user who can sync or upload that tree can make the publish task create a new directory outside the task work area and write that tree's repository metadata and...
PT-2026-107395
A flaw was found in pulp-rpm when it publishes a distribution tree. Addon and variant ids from .treeinfo are used as directory names. A user who can sync or upload that tree can make the publish task create a new directory outside the task work area and write that tree's repository metadata and...
pulp-ansible (>=0.22.0, <=0.23.1), pulp-container (>=2.21.0, <=2.22.13) +6 more potentially affected by CVE-2026-90959 via pulpcore (3.69.2)
pulpcore PYPI version 3.69.2 is affected by a known vulnerability. The following packages have a transitive dependency on pulpcore and may be impacted: - pulp-ansible =0.22.0, =2.21.0, =3.3.0, =0.6.0, =0.8.1, =2.4.0, =3.12.0, =3.25.6, =3.27.14 Source cves: CVE-2026-90959 Source advisory:...
galaxy-ng (>=4.6.0, <=4.6.6), pulp-rpm (>=3.17.6, <=3.17.22) +1 more potentially affected by CVE-2026-0994 via protobuf (4.22.0rc3)
protobuf PYPI version 4.22.0rc3 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - galaxy-ng =4.6.0, =3.17.6, =3.21.0, =3.21.36 Source cves: CVE-2026-0994 Source advisory: OSV:PYSEC-2026-1805...
galaxy-ng (>=4.6.0, <=4.6.6), pulp-rpm (>=3.17.6, <=3.17.22) +1 more potentially affected by CVE-2026-0994 via protobuf (4.22.0rc3)
protobuf PYPI version 4.22.0rc3 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - galaxy-ng =4.6.0, =3.17.6, =3.21.0, =3.21.36 Source cves: CVE-2026-0994 Source advisory: OSV:GHSA-7GCM-G887-7QV7...
[SECURITY] Fedora 24 Update: pulp-rpm-2.8.6-2.fc24
Provides a collection of platform plugins, client extensions and agent handlers that provide RPM support...
Fedora Update for pulp-rpm FEDORA-2016-f9db2293a8
The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...