pulp.spec in the installation process for Pulp 2.8.3 generates the RSA key pairs used to…
Priority LOW 25CWE-200Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-200.
Summary
pulp.spec in the installation process for Pulp 2.8.3 generates the RSA key pairs used to validate messages between the pulp server and pulp consumers in a directory that is world-readable before later modifying the permissions, which might allow local users to read the generated RSA keys via reading the key files while the installation process is running.
Why it matters now
EPSS 0.0039 33rd percentileScored 2026-11-07
Fix Fixed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:pulpproject:pulp:*:*:*:*:*:*:*:* | up to 2.8.2-1 | Vulnerable | Pulpproject |
- cpe:2.3:a:pulpproject:pulp:*:*:*:*:*:*:*:* Versions up to 2.8.2-1 Vulnerable ·Pulpproject
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Satellite 6.2 | Fixed | — |
| Red Hat Satellite Capsule 6.2 | Fixed | — |
Timeline
- 2026-10-02 Threatist record created from CVE-2016-3111
- 2026-10-03 Alias added: GHSA-fgrp-5xv9-qv52
References
Patch 6
- http://pkgs.fedoraproject.org/cgit/rpms/pulp.git/tree/pulp.spec#n620
- http://pkgs.fedoraproject.org/cgit/rpms/pulp.git/tree/pulp.spec#n317
- https://bugzilla.redhat.com/show_bug.cgi?id=1326251
- https://pulp.plan.io/issues/1837
- https://github.com/pulp/pulp/blob/master/pulp.spec#L894-L903
- https://github.com/pulp/pulp/blob/master/pulp.spec#L473-L486
More Pulpproject Pulp vulnerabilities
- TI-2024-06611 Pulpcore: rbac permissions incorrectly assigned in tasks that create objects CVSS 3.1HIGH 8.3
- TI-2016-03134 Pulp before 2.8.5 uses bash's $RANDOM in an unsafe way to generate passwords. CVSS 3.0HIGH 7.5
- TI-2016-02610 client/consumer/cli.py in Pulp before 2.8.3 writes consumer private keys to… CVSS 3.0HIGH 7.5
- TI-2015-04422 pulp-consumer-client 2.4.0 through 2.6.3 does not check the server's TLS certificate… CVSS 3.0HIGH 8.1
- TI-2018-01009 Information disclosure in [UNKNOWN] pulp CVSS 3.0HIGH 7.5
- TI-2013-06102 Pulp before 2.3.0 uses the same the same certificate authority key and certificate for all installations. CVSS 3.0HIGH 7.5
Sources
- CVE-2016-3111 · CVE Program
- CVE-2016-3111 · NVD
- FIRST EPSS
- GHSA-fgrp-5xv9-qv52 · GitHub Advisory Database · CC BY 4.0
- CVE-2016-3111 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences