TI-2024-06611 CVE-2024-7143 · GHSA-9m5j-4xx9-44j9
Pulpcore: rbac permissions incorrectly assigned in tasks that create objects
Priority LOW 39
A flaw was found in the Pulp package.
Pulpproject
Records15All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high8CVSS 7.0–8.9
Exploited now
Pulpproject records in CISA KEVNo Pulpproject vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
13 records in Pulp · all components
TI-2016-03134 CVE-2016-3704 · GHSA-r3j4-3vf9-657w
Pulp before 2.8.5 uses bash's $RANDOM in an unsafe way to generate passwords.
Priority LOW 37
Pulp before 2.8.5 uses bash's $RANDOM in an unsafe way to generate passwords.
TI-2016-02610 CVE-2016-3112 · GHSA-3j4c-jhfg-648f
client/consumer/cli.py in Pulp before 2.8.3 writes consumer private keys to…
Priority LOW 37
client/consumer/cli.py in Pulp before 2.8.3 writes consumer private keys to etc/pki/pulp/consumer/consumer-cert.pem as world-readable, which allows remote authenticated users to obtain the consumer private keys and escal…
TI-2015-04422 CVE-2015-5263 · GHSA-2vfx-6mjq-9ccv
pulp-consumer-client 2.4.0 through 2.6.3 does not check the server's TLS certificate…
Priority LOW 37
pulp-consumer-client 2.4.0 through 2.6.3 does not check the server's TLS certificate signatures when retrieving the server's public key upon registration.
TI-2018-01009 CVE-2018-1090 · GHSA-4j55-qh92-5qjq
Information disclosure in [UNKNOWN] pulp
Priority LOW 36
In Pulp before version 2.16.2, secrets are passed into override_config when triggering a task and then become readable to all users with read access on the distributor/importer.
TI-2013-06102 CVE-2013-7450 · GHSA-jc26-4cgx-755j
Pulp before 2.3.0 uses the same the same certificate authority key and certificate for all installations.
Priority LOW 34
Pulp before 2.3.0 uses the same the same certificate authority key and certificate for all installations.
TI-2018-07729 CVE-2018-10917
Path traversal in [UNKNOWN] pulp
Priority LOW 32
pulp 2.16.x and possibly older is vulnerable to an improper path parsing.
TI-2016-02606 CVE-2016-3108 · GHSA-2wh2-4qxg-w52c
The pulp-gen-nodes-certificate script in Pulp before 2.8.3 allows local users to leak the…
Priority LOW 31
The pulp-gen-nodes-certificate script in Pulp before 2.8.3 allows local users to leak the keys or write to arbitrary files via a symlink attack.
TI-2016-02604 CVE-2016-3106 · GHSA-mjm3-39h3-6qgg
Pulp before 2.8.3 creates a temporary directory during CA key generation in an insecure manner.
Priority LOW 26
Pulp before 2.8.3 creates a temporary directory during CA key generation in an insecure manner.
TI-2016-03128 CVE-2016-3696 · GHSA-m563-8c32-w7fx
The pulp-qpid-ssl-cfg script in Pulp before 2.8.5 allows local users to obtain the CA key.
Priority LOW 25
The pulp-qpid-ssl-cfg script in Pulp before 2.8.5 allows local users to obtain the CA key.
TI-2016-02609 CVE-2016-3111 · GHSA-fgrp-5xv9-qv52
pulp.spec in the installation process for Pulp 2.8.3 generates the RSA key pairs used to…
Priority LOW 25
pulp.spec in the installation process for Pulp 2.8.3 generates the RSA key pairs used to validate messages between the pulp server and pulp consumers in a directory that is world-readable before later modifying the permi…
TI-2016-02594 CVE-2016-3095 · GHSA-rgm2-v748-933h
server/bin/pulp-gen-ca-certificate in Pulp before 2.8.2 allows local users to read the generated private key.
Priority LOW 25
server/bin/pulp-gen-ca-certificate in Pulp before 2.8.2 allows local users to read the generated private key.
TI-2016-02605 CVE-2016-3107 · GHSA-v3xg-vpph-2hjg
The Node certificate in Pulp before 2.8.3 contains the private key, and is stored in a…
Priority LOW 24
The Node certificate in Pulp before 2.8.3 contains the private key, and is stored in a world-readable file in the "/etc/pki/pulp/nodes/" directory, which allows local users to gain access to sensitive data.