Pulp vulnerabilities
5 known CVE vulnerabilities in Pulp, translated and rated.
- CVE-2015-5153High
Pulp does not remove permissions for named objects upon deletion, which allows authenticated users to gain the privileges of a deleted object via creating an object with the same name.
- CVE-2016-3704High
Pulp before 2.8.5 uses bash's $RANDOM in an unsafe way to generate passwords.
- CVE-2016-3112High
In Pulp before version 2.8.3, the consumer private key is written to etc/pki/pulp/consumer/consumer-cert.pem with world-readable permissions. This allows remote authenticated users to obtain the consumer private keys and escalate privileges.
- CVE-2016-3108High
The pulp-gen-nodes-certificate script in Pulp before 2.8.3 allows local users to leak keys or write to arbitrary files via a symlink attack.
- CVE-2013-7450High
Pulp before version 2.3.0 uses the same certificate authority key and certificate for all installations.