CVE-2016-3112: Improper Access Control

client/consumer/cli.py in Pulp before 2.8.3 writes consumer private keys to etc/pki/pulp/consumer/consumer-cert.pem as world-readable, which allows remote authenticated users to obtain the consumer private keys and escalate privileges by reading /etc/pki/pulp/consumer/consumer-cert, and...

CVE-2016-3107: Improper Access Control

The Node certificate in Pulp before 2.8.3 contains the private key, and is stored in a world-readable file in the "/etc/pki/pulp/nodes/" directory, which allows local users to gain access to sensitive data...

CVE-2016-3095: Exposure of Sensitive Information to an Unauthorized Actor

server/bin/pulp-gen-ca-certificate in Pulp before 2.8.2 allows local users to read the generated private key...

CVE-2016-3106

Pulp before 2.8.3 creates a temporary directory during CA key generation in an insecure manner...

CVE-2016-3106

Pulp before 2.8.3 creates a temporary directory during CA key generation in an insecure manner...

Information disclosure

Pulp before 2.8.3 creates a temporary directory during CA key generation in an insecure manner...

CVE-2016-3106

Pulp before 2.8.3 creates a temporary directory during CA key generation in an insecure manner...

CVE-2016-3106

CVE-2016-3106 : Pulp before 2.8.3 creates a temporary directory during CA key generation in an insecure manner, enabling potential exposure of sensitive data. The vulnerability affects Pulp’s CA key generation process; CVSS vectors indicate network access with low complexity and partial confident...

CVE-2016-3106: Concurrent Execution using Shared Resource with Improper Synchronization

Pulp before 2.8.3 creates a temporary directory during CA key generation in an insecure manner...

CVE-2013-7450

Pulp before 2.3.0 uses the same the same certificate authority key and certificate for all installations...

Design/Logic Flaw

Pulp before 2.3.0 uses the same the same certificate authority key and certificate for all installations...

CVE-2013-7450

Pulp before 2.3.0 uses the same the same certificate authority key and certificate for all installations...

CVE-2013-7450

CVE-2013-7450 affects Pulp versions before 2.3.0. The root cause is that the same CA key and certificate are used across all installations, creating a single trusted-trust anchor per deployment. Reported impact includes potential modification of the CA certificate, undermining PKI trust. Exploita...

CVE-2013-7450: Improper Certificate Validation

Pulp before 2.3.0 uses the same the same certificate authority key and certificate for all installations...

Fedora Update for pulp-ostree FEDORA-2016-4373f7d32a

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora Update for pulp-python FEDORA-2016-4373f7d32a

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora Update for pulp-docker FEDORA-2016-4373f7d32a

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora Update for pulp FEDORA-2016-4373f7d32a

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora Update for pulp-puppet FEDORA-2016-4373f7d32a

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 24 : pulp / pulp-docker / pulp-ostree / pulp-puppet / pulp-python / etc (2016-4373f7d32a)

2.8.6 is a security and bugfix release. Included in the list of fixed issues in 2.8.5 are two CVEs : - CVE-2016-3696: Leakage of CA key in pulp-qpid-ssl-cfg - CVE-2016-3704: Unsafe use of bash $RANDOM for NSS DB password and seed Several issues with database migrations are also addressed in this...