PT-2017-5756 · Pulp · Pulp

Andrej Nemec · Published 2017-04-03 · Updated 2017-04-26 · CVE-2013-7450

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Pulp versions prior to 2.3.0

Description: The issue arises from Pulp using the same certificate authority key and certificate across all installations. This could potentially lead to security issues due to the lack of unique identification and authentication for each installation.

Recommendations: For versions prior to 2.3.0, update to version 2.3.0 or later to resolve the issue.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2013-7450

Affected Products

Pulp

References · 7

• https://github.com/pulp/pulp/pull/627 · Patch
• https://bugzilla.redhat.com/show_bug.cgi?id=1003326 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2013-7450 · Security Note
• http://openwall.com/lists/oss-security/2016/04/18/5 · Patch
• https://bugzilla.redhat.com/show_bug.cgi?id=1328345 · Patch
• http://openwall.com/lists/oss-security/2016/05/20/1 · Note
• http://openwall.com/lists/oss-security/2016/04/18/11 · Note