CVE-2016-3112
HighSummary
In Pulp before version 2.8.3, the consumer private key is written to etc/pki/pulp/consumer/consumer-cert.pem with world-readable permissions. This allows remote authenticated users to obtain the consumer private keys and escalate privileges.
Risk Assessment
The organization is at risk of unauthorized access to private keys, which could lead to privilege escalation and potential security breaches.
Recommendation
It is recommended to update Pulp to version 2.8.3 or later and to restrict permissions on the private key file so that only authorized users can read it.
Other vulnerabilities in Pulp
See all- CVE-2015-5153High
Pulp does not remove permissions for named objects upon deletion, which allows authenticated users to gain the privileges of a deleted object via creating an object with the same name.
- CVE-2016-3704High
Pulp before 2.8.5 uses bash's $RANDOM in an unsafe way to generate passwords.
- CVE-2016-3108High
The pulp-gen-nodes-certificate script in Pulp before 2.8.3 allows local users to leak keys or write to arbitrary files via a symlink attack.
- CVE-2013-7450High
Pulp before version 2.3.0 uses the same certificate authority key and certificate for all installations.
Original NVD description (English source)
client/consumer/cli.py in Pulp before 2.8.3 writes consumer private keys to etc/pki/pulp/consumer/consumer-cert.pem as world-readable, which allows remote authenticated users to obtain the consumer private keys and escalate privileges by reading /etc/pki/pulp/consumer/consumer-cert, and authenticating as a consumer user.