PT-2017-8340 · Pulp · Pulp

Jeremy Cline · Published 2017-06-08 · Updated 2023-02-13 · CVE-2016-3111

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Pulp version 2.8.3

Description The issue arises during the installation process of Pulp, where the pulp.spec generates RSA key pairs in a world-readable directory before modifying the permissions. This might allow local users to read the generated RSA keys by accessing the key files while the installation is in progress.

Recommendations For Pulp version 2.8.3, consider restricting access to the directory where the RSA key pairs are generated during the installation process to prevent local users from reading the keys. As a temporary workaround, monitor the installation process closely to minimize the time the key files are exposed.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2016-3111

Affected Products

Pulp

References · 11

• https://github.com/pulp/pulp/blob/master/pulp.spec#L473-L486 · Patch
• https://github.com/pulp/pulp/blob/master/pulp.spec#L894-L903 · Patch
• http://pkgs.fedoraproject.org/cgit/rpms/pulp.git/tree/pulp.spec#n317 · Patch
• https://pulp.plan.io/issues/1837 · Vendor Advisory
• http://pkgs.fedoraproject.org/cgit/rpms/pulp.git/tree/pulp.spec#n620 · Patch
• https://bugzilla.redhat.com/show_bug.cgi?id=1326251 · Patch
• https://osv.dev/vulnerability/CVE-2016-3111 · Vendor Advisory
• https://access.redhat.com/errata/RHBA-2016:1501 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-3111 · Security Note
• http://openwall.com/lists/oss-security/2016/05/20/1 · Note
• https://bugzilla.redhat.com/attachment.cgi?id=1146522 · Note