pypi pulpcore vulnerabilities

Latest pypi pulpcore CVEs

Newest publication first

1. CVE-2024-7143 Pulpcore: rbac permissions incorrectly assigned in tasks that create objects

   Published 2024-08-07

   High·CVSS 8.3 EPSS 0.61%

   A flaw was found in the Pulp package. When a role-based access control (RBAC) object in Pulp is set to assign permissions on its creation, it uses the AutoAddObjPermsMixin (typically the add_roles_for_object_creator method). This method finds the object creator by checking the cu...

2. CVE-2018-10917 Withdrawn Advisory: Pulp Improper Path Parsing

   Published 2018-08-15

   Medium·CVSS 6.5 EPSS 1.1%

   pulp 2.16.x and possibly older is vulnerable to an improper path parsing. A malicious user or a malicious iso feed repository can write to locations accessible to the 'apache' user. This may lead to overwrite of published content on other iso repositories.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.