CVE-2016-3107 The Node certificate in Pulp before 2.8.3 contains the private key, and is stored in a world-readable file in the "/etc/pki/pulp/nodes/" directory, which allows local users to gain access to sensitive...
MediumCVSS 5.5
EPSS 0.20%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Node certificate in Pulp before 2.8.3 contains the private key, and is stored in a world-readable file in the "/etc/pki/pulp/nodes/" directory, which allows local users to gain access to sensitive data.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pulpproject pulp | <= 2.8.2-1 | No fix listed |
References
- [oss-security] 20160519 Pulp 2.8.3 Released to address multiple CVEs mailing-list third-party-advisory
- RHBA-2016:1501 vendor-advisory
- bugzilla.redhat.com issue-tracking
- bugzilla.redhat.com issue-tracking
- pulp.plan.io patch vendor-advisory