CVE-2016-3095 server/bin/pulp-gen-ca-certificate in Pulp before 2.8.2 allows local users to read the generated private key.
MediumCVSS 5.5
EPSS 0.30%
- Published
- Updated
- Exploit status
- No public exploit known
Description
server/bin/pulp-gen-ca-certificate in Pulp before 2.8.2 allows local users to read the generated private key.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fedoraproject fedora | = 24 | No fix listed |
| pulpproject pulp | <= 2.8.1 | No fix listed |
References
- FEDORA-2016-f75bd73891 third-party-advisory vendor-advisory
- [oss-security] 20160406 Pulp 2.8.2 release for CVE-2016-3095 mailing-list third-party-advisory
- [oss-security] 20160418 CVE-2013-7450: Pulp < 2.3.0 distributed the same CA key to all users mailing-list third-party-advisory
- bugzilla.redhat.com exploit issue-tracking patch third-party-advisory vdb-entry
- github.com patch third-party-advisory