CVE-2016-3108
HighSummary
The pulp-gen-nodes-certificate script in Pulp before 2.8.3 allows local users to leak keys or write to arbitrary files via a symlink attack.
Risk Assessment
Attackers can exploit this vulnerability to gain access to sensitive data or manipulate files, potentially leading to serious security breaches.
Recommendation
It is recommended to upgrade Pulp to version 2.8.3 or later to mitigate this vulnerability.
Other vulnerabilities in Pulp
See all- CVE-2015-5153High
Pulp does not remove permissions for named objects upon deletion, which allows authenticated users to gain the privileges of a deleted object via creating an object with the same name.
- CVE-2016-3704High
Pulp before 2.8.5 uses bash's $RANDOM in an unsafe way to generate passwords.
- CVE-2016-3112High
In Pulp before version 2.8.3, the consumer private key is written to etc/pki/pulp/consumer/consumer-cert.pem with world-readable permissions. This allows remote authenticated users to obtain the consumer private keys and escalate privileges.
- CVE-2013-7450High
Pulp before version 2.3.0 uses the same certificate authority key and certificate for all installations.
Original NVD description (English source)
The pulp-gen-nodes-certificate script in Pulp before 2.8.3 allows local users to leak the keys or write to arbitrary files via a symlink attack.