PT-2017-5756 · Pulp · Pulp

Andrej Nemec · Publicado 2017-04-03 · Atualizado 2017-04-26 · CVE-2013-7450

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Pulp versions prior to 2.3.0

Description: The issue arises from Pulp using the same certificate authority key and certificate across all installations. This could potentially lead to security issues due to the lack of unique identification and authentication for each installation.

Recommendations: For versions prior to 2.3.0, update to version 2.3.0 or later to resolve the issue.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2013-7450

Produtos afetados

Pulp

Referências · 7

• https://github.com/pulp/pulp/pull/627 · Correção
• https://bugzilla.redhat.com/show_bug.cgi?id=1003326 · Correção
• http://openwall.com/lists/oss-security/2016/05/20/1 · Nota
• http://openwall.com/lists/oss-security/2016/04/18/11 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-7450 · Nota de Segurança
• http://openwall.com/lists/oss-security/2016/04/18/5 · Correção
• https://bugzilla.redhat.com/show_bug.cgi?id=1328345 · Correção