CVE-2013-7450
HighSummary
Pulp before version 2.3.0 uses the same certificate authority key and certificate for all installations.
Risk Assessment
Using a common key and certificate may lead to security issues, such as the potential for impersonating other installations.
Recommendation
It is recommended to upgrade to Pulp version 2.3.0 or later to avoid security-related issues.
Other vulnerabilities in Pulp
See all- CVE-2015-5153High
Pulp does not remove permissions for named objects upon deletion, which allows authenticated users to gain the privileges of a deleted object via creating an object with the same name.
- CVE-2016-3704High
Pulp before 2.8.5 uses bash's $RANDOM in an unsafe way to generate passwords.
- CVE-2016-3112High
In Pulp before version 2.8.3, the consumer private key is written to etc/pki/pulp/consumer/consumer-cert.pem with world-readable permissions. This allows remote authenticated users to obtain the consumer private keys and escalate privileges.
- CVE-2016-3108High
The pulp-gen-nodes-certificate script in Pulp before 2.8.3 allows local users to leak keys or write to arbitrary files via a symlink attack.
Original NVD description (English source)
Pulp before 2.3.0 uses the same the same certificate authority key and certificate for all installations.