CVE-2018-1090 In Pulp before version 2.16.2, secrets are passed into override_config when triggering a task and then become readable to all users with read access on the distributor/importer. An attacker with API a...
HighCVSS 7.5
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In Pulp before version 2.16.2, secrets are passed into override_config when triggering a task and then become readable to all users with read access on the distributor/importer. An attacker with API access can then view these secrets.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pulpproject pulp | < 2.16.2 | 2.16.2 |
| fedoraproject fedora | All versions | No fix listed |
| redhat satellite | = 6.4 | No fix listed |
| [UNKNOWN] pulp | = pulp 2.16.2 | No fix listed |
References
- RHSA-2018:2927 third-party-advisory vendor-advisory
- bugzilla.redhat.com issue-tracking third-party-advisory
- pulp.plan.io vendor-advisory