CVE-2016-3108 The pulp-gen-nodes-certificate script in Pulp before 2.8.3 allows local users to leak the keys or write to arbitrary files via a symlink attack.
HighCVSS 7.1
EPSS 0.26%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The pulp-gen-nodes-certificate script in Pulp before 2.8.3 allows local users to leak the keys or write to arbitrary files via a symlink attack.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pulpproject pulp | <= 2.8.2-1 | No fix listed |
References
- [oss-security] 20160519 Pulp 2.8.3 Released to address multiple CVEs mailing-list third-party-advisory
- RHBA-2016:1501 vendor-advisory
- bugzilla.redhat.com issue-tracking
- bugzilla.redhat.com issue-tracking
- github.com issue-tracking patch third-party-advisory
- pulp.plan.io patch vendor-advisory