CVE-2015-5263 pulp-consumer-client 2.4.0 through 2.6.3 does not check the server's TLS certificate signatures when retrieving the server's public key upon registration.
HighCVSS 8.1
EPSS 0.87%
- Published
- Updated
- Exploit status
- No public exploit known
Description
pulp-consumer-client 2.4.0 through 2.6.3 does not check the server's TLS certificate signatures when retrieving the server's public key upon registration.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pulpproject pulp | = 2.4.0 | No fix listed |
| pulpproject pulp | = 2.4.1 | No fix listed |
| pulpproject pulp | = 2.4.2 | No fix listed |
| pulpproject pulp | = 2.4.3 | No fix listed |
| pulpproject pulp | = 2.4.4 | No fix listed |
| pulpproject pulp | = 2.5.0 | No fix listed |
| pulpproject pulp | = 2.5.1 | No fix listed |
| pulpproject pulp | = 2.5.2 | No fix listed |
| pulpproject pulp | = 2.5.3 | No fix listed |
| pulpproject pulp | = 2.6.0 | No fix listed |
| pulpproject pulp | = 2.6.1 | No fix listed |
| pulpproject pulp | = 2.6.2 | No fix listed |
| pulpproject pulp | = 2.6.3 | No fix listed |
References
- cve.killedkenny.io third-party-advisory
- [oss-security] 20150924 Pulp 2.6.4 released for CVE-2015-5263 mailing-list third-party-advisory
- github.com third-party-advisory
- github.com patch third-party-advisory