CVE-2016-3704
HighSummary
Pulp before 2.8.5 uses bash's $RANDOM in an unsafe way to generate passwords.
Risk Assessment
The use of $RANDOM may lead to predictable passwords, increasing the risk of unauthorized access to the system.
Recommendation
It is recommended to upgrade Pulp to version 2.8.5 or later to mitigate this vulnerability.
Other vulnerabilities in Pulp
See all- CVE-2015-5153High
Pulp does not remove permissions for named objects upon deletion, which allows authenticated users to gain the privileges of a deleted object via creating an object with the same name.
- CVE-2016-3112High
In Pulp before version 2.8.3, the consumer private key is written to etc/pki/pulp/consumer/consumer-cert.pem with world-readable permissions. This allows remote authenticated users to obtain the consumer private keys and escalate privileges.
- CVE-2016-3108High
The pulp-gen-nodes-certificate script in Pulp before 2.8.3 allows local users to leak keys or write to arbitrary files via a symlink attack.
- CVE-2013-7450High
Pulp before version 2.3.0 uses the same certificate authority key and certificate for all installations.
Original NVD description (English source)
Pulp before 2.8.5 uses bash's $RANDOM in an unsafe way to generate passwords.