Pulp Security Vulnerabilities and Issues — Pulp CVE List

Lucene search

PulpprojectPulp

5 matches found

CVE•added 2018/06/18 2:29 p.m.•58 views

CVE-2018-1090

In Pulp before version 2.16.2, secrets are passed into override_config when triggering a task and then become readable to all users with read access on the distributor/importer. An attacker with API access can then view these secrets.

7.5CVSS7.3AI score0.00289EPSS

CVE•added 2017/06/13 5:29 p.m.•51 views

CVE-2016-3704

Pulp before 2.8.5 uses bash's $RANDOM in an unsafe way to generate passwords.

7.5CVSS7.2AI score0.00543EPSS

CVE•added 2017/06/08 6:29 p.m.•49 views

CVE-2016-3112

client/consumer/cli.py in Pulp before 2.8.3 writes consumer private keys to etc/pki/pulp/consumer/consumer-cert.pem as world-readable, which allows remote authenticated users to obtain the consumer private keys and escalate privileges by reading /etc/pki/pulp/consumer/consumer-cert, and authenticat...

7.5CVSS7.3AI score0.00421EPSS

CVE•added 2017/06/08 6:29 p.m.•39 views

CVE-2016-3108

The pulp-gen-nodes-certificate script in Pulp before 2.8.3 allows local users to leak the keys or write to arbitrary files via a symlink attack.

7.1CVSS6.7AI score0.00041EPSS

CVE•added 2017/04/03 3:59 p.m.•33 views

CVE-2013-7450

Pulp before 2.3.0 uses the same the same certificate authority key and certificate for all installations.

7.5CVSS7.6AI score0.00324EPSS