Pulpcore: rbac permissions incorrectly assigned in tasks that create objects
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · Low
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
A flaw was found in the Pulp package. When a role-based access control (RBAC) object in Pulp is set to assign permissions on its creation, it uses the `AutoAddObjPermsMixin` (typically the add_roles_for_object_creator method). This method finds the object creator by checking the current authenticated user. For objects that are created within a task, this current user is set by the first user with any permissions on the task object. This means the oldest user with model/domain-level task permissions will always be set as the current user of a task, even if they didn't dispatch the task. Therefore, all objects created in tasks will have their permissions assigned to this oldest user, and the creating user will receive nothing.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | pulp | up to 3.56.0 | — | No fix listed | CNA |
| Red Hat | Red Hat Ansible Automation Platform 2 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Ansible Automation Platform 2 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Satellite 6 | — | — | Not affected | CNA |
| Red Hat | Red Hat Update Infrastructure 4 for Cloud Providers | — | — | Not affected | CNA |
| — | pulpcore (PyPI) | up to 3.56.0 | — | No fix listed | GHSA-9m5j-4xx9-44j9 |
- pulp Vendor— Affected up to 3.56.0 Fixed in — No fix listed CNA
- Red Hat Ansible Automation Platform 2 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Ansible Automation Platform 2 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Satellite 6 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Update Infrastructure 4 for Cloud Providers VendorRed Hat Affected — Fixed in — Not affected CNA
- pulpcore (PyPI) Vendor— Affected up to 3.56.0 Fixed in — No fix listed GHSA-9m5j-4xx9-44j9
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:pulpproject:pulp:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Pulpproject |
| cpe:2.3:a:redhat:ansible_automation_platform:2.0:*:*:*:*:*:*:* | 2.0 | Running on | Red Hat |
- cpe:2.3:a:pulpproject:pulp:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Pulpproject
- cpe:2.3:a:redhat:ansible_automation_platform:2.0:*:*:*:*:*:*:* Versions 2.0 Running on ·Red Hat
Remediation
Red Hat 1 advisory
- RHSA-2024:6765 Released 2024-09-18 · Red Hat rating ModerateRed Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.4 for RHEL 8 automation-controller-4.5.11-1.el8ap, automation-controller-cli-4.5.11-1.el8ap, automation-controller-server-4.5.11-1.el8ap +10
- Red Hat Ansible Automation Platform 2.4 for RHEL 9 automation-controller-4.5.11-1.el9ap, automation-controller-cli-4.5.11-1.el9ap, automation-controller-server-4.5.11-1.el9ap +10
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
Not affected: 2 products
- Red Hat Satellite 6
- Red Hat Update Infrastructure 4 for Cloud Providers
Timeline
- 2026-10-02 Threatist record created from CVE-2024-7143
- 2026-10-03 Alias added: GHSA-9m5j-4xx9-44j9
References
Advisory 4
More Red Hat vulnerabilities
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
- TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2024-7143 · CVE Program
- CVE-2024-7143 · NVD
- FIRST EPSS
- GHSA-9m5j-4xx9-44j9 · GitHub Advisory Database · CC BY 4.0
- CVE-2024-7143 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences