PT-2017-8340 · Pulp · Pulp

Jeremy Cline · Publicado 2017-06-08 · Atualizado 2023-02-13 · CVE-2016-3111

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Pulp version 2.8.3

Description The issue arises during the installation process of Pulp, where the pulp.spec generates RSA key pairs in a world-readable directory before modifying the permissions. This might allow local users to read the generated RSA keys by accessing the key files while the installation is in progress.

Recommendations For Pulp version 2.8.3, consider restricting access to the directory where the RSA key pairs are generated during the installation process to prevent local users from reading the keys. As a temporary workaround, monitor the installation process closely to minimize the time the key files are exposed.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2016-3111

Produtos afetados

Pulp

Referências · 11

• https://github.com/pulp/pulp/blob/master/pulp.spec#L473-L486 · Correção
• https://github.com/pulp/pulp/blob/master/pulp.spec#L894-L903 · Correção
• http://pkgs.fedoraproject.org/cgit/rpms/pulp.git/tree/pulp.spec#n317 · Correção
• https://pulp.plan.io/issues/1837 · Aviso do Fabricante
• http://pkgs.fedoraproject.org/cgit/rpms/pulp.git/tree/pulp.spec#n620 · Correção
• https://bugzilla.redhat.com/show_bug.cgi?id=1326251 · Correção
• https://osv.dev/vulnerability/CVE-2016-3111 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2016/05/20/1 · Nota
• https://access.redhat.com/errata/RHBA-2016:1501 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-3111 · Nota de Segurança
• https://bugzilla.redhat.com/attachment.cgi?id=1146522 · Nota