CVE-2016-3111 pulp.spec in the installation process for Pulp 2.8.3 generates the RSA key pairs used to validate messages between the pulp server and pulp consumers in a directory that is world-readable before later...
MediumCVSS 5.5
EPSS 0.39%
- Published
- Updated
- Exploit status
- No public exploit known
Description
pulp.spec in the installation process for Pulp 2.8.3 generates the RSA key pairs used to validate messages between the pulp server and pulp consumers in a directory that is world-readable before later modifying the permissions, which might allow local users to read the generated RSA keys via reading the key files while the installation process is running.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pulpproject pulp | <= 2.8.2-1 | No fix listed |
References
- pkgs.fedoraproject.org issue-tracking patch third-party-advisory
- [oss-security] 20160519 Pulp 2.8.3 Released to address multiple CVEs mailing-list third-party-advisory
- RHBA-2016:1501 vendor-advisory
- bugzilla.redhat.com issue-tracking
- bugzilla.redhat.com issue-tracking patch
- github.com issue-tracking patch third-party-advisory
- pulp.plan.io patch vendor-advisory