290 matches found
CVE-2016-3108
The pulp-gen-nodes-certificate script in Pulp before 2.8.3 allows local users to leak the keys or write to arbitrary files via a symlink attack...
CVE-2016-3107
The Node certificate in Pulp before 2.8.3 contains the private key, and is stored in a world-readable file in the "/etc/pki/pulp/nodes/" directory, which allows local users to gain access to sensitive data...
CVE-2016-3112
client/consumer/cli.py in Pulp before 2.8.3 writes consumer private keys to etc/pki/pulp/consumer/consumer-cert.pem as world-readable, which allows remote authenticated users to obtain the consumer private keys and escalate privileges by reading /etc/pki/pulp/consumer/consumer-cert, and...
CVE-2016-3112
client/consumer/cli.py in Pulp before 2.8.3 writes consumer private keys to etc/pki/pulp/consumer/consumer-cert.pem as world-readable, which allows remote authenticated users to obtain the consumer private keys and escalate privileges by reading /etc/pki/pulp/consumer/consumer-cert, and...
CVE-2016-3111
CVE-2016-3111 affects Pulp 2.8.3 during installation. The root cause is that the build/install process (pulp.spec) generates RSA key pairs in a directory that is temporarily world-readable, potentially allowing local users to read the keys while the installation runs. The available connected sour...
CVE-2016-3107
CVE-2016-3107 affects Pulp: the Node certificate private key is stored in a world‑readable file under /etc/pki/pulp/nodes/, enabling local users to access sensitive data. Affected versions: Pulp before 2.8.3. Root cause: insecure file permissions on the node certificate. Impact: potential disclos...
CVE-2016-3108
CVE-2016-3108 affects the pulp-gen-nodes-certificate script in Pulp (before 2.8.3). The vulnerability allows local users to leak keys or write to arbitrary files via a symlink attack . This aligns with the NVD entry describing the issue and the CVSS3 vector indicating local access, low attack com...
CVE-2016-3108
The pulp-gen-nodes-certificate script in Pulp before 2.8.3 allows local users to leak the keys or write to arbitrary files via a symlink attack...
PT-2017-8341 · Pulp · Pulp
Name of the Vulnerable Software and Affected Versions: Pulp versions prior to 2.8.3 Description: The issue allows remote authenticated users to obtain consumer private keys and escalate privileges. This is due to the world-readable writing of consumer private keys to...
PT-2017-8338 · Pulp · Pulp
Name of the Vulnerable Software and Affected Versions: Pulp versions prior to 2.8.3 Description: The issue allows local users to leak keys or write to arbitrary files via a symlink attack, specifically targeting the pulp-gen-nodes-certificate script in Pulp. Recommendations: For versions prior to...
PT-2017-8331
Name of the Vulnerable Software and Affected Versions Pulp versions prior to 2.8.2 Description The issue allows local users to read the generated private key due to a problem in the server/bin/pulp-gen-ca-certificate functionality. Recommendations For versions prior to 2.8.2, update to version...
CVE-2016-3111: Exposure of Sensitive Information to an Unauthorized Actor
pulp.spec in the installation process for Pulp 2.8.3 generates the RSA key pairs used to validate messages between the pulp server and pulp consumers in a directory that is world-readable before later modifying the permissions, which might allow local users to read the generated RSA keys via...
CVE-2016-3095: Exposure of Sensitive Information to an Unauthorized Actor
server/bin/pulp-gen-ca-certificate in Pulp before 2.8.2 allows local users to read the generated private key...
CVE-2016-3107: Improper Access Control
The Node certificate in Pulp before 2.8.3 contains the private key, and is stored in a world-readable file in the "/etc/pki/pulp/nodes/" directory, which allows local users to gain access to sensitive data...
CVE-2016-3112: Improper Access Control
client/consumer/cli.py in Pulp before 2.8.3 writes consumer private keys to etc/pki/pulp/consumer/consumer-cert.pem as world-readable, which allows remote authenticated users to obtain the consumer private keys and escalate privileges by reading /etc/pki/pulp/consumer/consumer-cert, and...
CVE-2016-3108: Improper Link Resolution Before File Access
The pulp-gen-nodes-certificate script in Pulp before 2.8.3 allows local users to leak the keys or write to arbitrary files via a symlink attack...
PT-2017-8337 · Pulp · Pulp
Name of the Vulnerable Software and Affected Versions: Pulp versions prior to 2.8.3 Description: The issue concerns a world-readable file containing the private key for the Node certificate, stored in the "/etc/pki/pulp/nodes/" directory. This allows local users to access sensitive data,...
PT-2017-8340 · Pulp · Pulp
Name of the Vulnerable Software and Affected Versions: Pulp version 2.8.3 Description: The issue arises during the installation process of Pulp, where the pulp.spec generates RSA key pairs in a world-readable directory before modifying the permissions. This might allow local users to read the...
