TI-2024-06611 CVE-2024-7143 · GHSA-9m5j-4xx9-44j9
Pulpcore: rbac permissions incorrectly assigned in tasks that create objects
Priority LOW 39
A flaw was found in the Pulp package.
Vulnerabilities
15 records
TI-2022-03352 CVE-2022-3644 · GHSA-qv37-mfjf-42h8
Insufficiently protected credentials in pulp_ansible
Priority MEDIUM 58
The collection remote for pulp_ansible stores tokens in plaintext instead of using pulp's encrypted field and exposes them in read/write mode via the API () instead of marking it as write only.
TI-2018-07729 CVE-2018-10917
Path traversal in [UNKNOWN] pulp
Priority LOW 32
pulp 2.16.x and possibly older is vulnerable to an improper path parsing.
TI-2018-01009 CVE-2018-1090 · GHSA-4j55-qh92-5qjq
Information disclosure in [UNKNOWN] pulp
Priority LOW 36
In Pulp before version 2.16.2, secrets are passed into override_config when triggering a task and then become readable to all users with read access on the distributor/importer.
TI-2015-04332 CVE-2015-5164 · GHSA-p95x-pv3h-fh38
The Qpid server on Red Hat Satellite 6 does not properly restrict message types, which…
Priority LOW 38
The Qpid server on Red Hat Satellite 6 does not properly restrict message types, which allows remote authenticated users with administrative access on a managed content host to execute arbitrary code via a crafted messag…
TI-2015-04422 CVE-2015-5263 · GHSA-2vfx-6mjq-9ccv
pulp-consumer-client 2.4.0 through 2.6.3 does not check the server's TLS certificate…
Priority LOW 37
pulp-consumer-client 2.4.0 through 2.6.3 does not check the server's TLS certificate signatures when retrieving the server's public key upon registration.
TI-2016-03134 CVE-2016-3704 · GHSA-r3j4-3vf9-657w
Pulp before 2.8.5 uses bash's $RANDOM in an unsafe way to generate passwords.
Priority LOW 37
Pulp before 2.8.5 uses bash's $RANDOM in an unsafe way to generate passwords.
TI-2016-03128 CVE-2016-3696 · GHSA-m563-8c32-w7fx
The pulp-qpid-ssl-cfg script in Pulp before 2.8.5 allows local users to obtain the CA key.
Priority LOW 25
The pulp-qpid-ssl-cfg script in Pulp before 2.8.5 allows local users to obtain the CA key.
TI-2016-02594 CVE-2016-3095 · GHSA-rgm2-v748-933h
server/bin/pulp-gen-ca-certificate in Pulp before 2.8.2 allows local users to read the generated private key.
Priority LOW 25
server/bin/pulp-gen-ca-certificate in Pulp before 2.8.2 allows local users to read the generated private key.
TI-2016-02610 CVE-2016-3112 · GHSA-3j4c-jhfg-648f
client/consumer/cli.py in Pulp before 2.8.3 writes consumer private keys to…
Priority LOW 37
client/consumer/cli.py in Pulp before 2.8.3 writes consumer private keys to etc/pki/pulp/consumer/consumer-cert.pem as world-readable, which allows remote authenticated users to obtain the consumer private keys and escal…
TI-2016-02609 CVE-2016-3111 · GHSA-fgrp-5xv9-qv52
pulp.spec in the installation process for Pulp 2.8.3 generates the RSA key pairs used to…
Priority LOW 25
pulp.spec in the installation process for Pulp 2.8.3 generates the RSA key pairs used to validate messages between the pulp server and pulp consumers in a directory that is world-readable before later modifying the permi…
TI-2016-02606 CVE-2016-3108 · GHSA-2wh2-4qxg-w52c
The pulp-gen-nodes-certificate script in Pulp before 2.8.3 allows local users to leak the…
Priority LOW 31
The pulp-gen-nodes-certificate script in Pulp before 2.8.3 allows local users to leak the keys or write to arbitrary files via a symlink attack.
TI-2016-02605 CVE-2016-3107 · GHSA-v3xg-vpph-2hjg
The Node certificate in Pulp before 2.8.3 contains the private key, and is stored in a…
Priority LOW 24
The Node certificate in Pulp before 2.8.3 contains the private key, and is stored in a world-readable file in the "/etc/pki/pulp/nodes/" directory, which allows local users to gain access to sensitive data.
TI-2016-02604 CVE-2016-3106 · GHSA-mjm3-39h3-6qgg
Pulp before 2.8.3 creates a temporary directory during CA key generation in an insecure manner.
Priority LOW 26
Pulp before 2.8.3 creates a temporary directory during CA key generation in an insecure manner.
TI-2013-06102 CVE-2013-7450 · GHSA-jc26-4cgx-755j
Pulp before 2.3.0 uses the same the same certificate authority key and certificate for all installations.
Priority LOW 34
Pulp before 2.3.0 uses the same the same certificate authority key and certificate for all installations.