CVE-2016-3111

low-risk

Published 2017-06-08

pulp.spec in the installation process for Pulp 2.8.3 generates the RSA key pairs used to validate messages between the pulp server and pulp consumers in a directory that is world-readable before later modifying the permissions, which might allow local users to read the generated RSA keys via reading the key files while the installation process is running.

Do I need to act?

0.05% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.5/10 Medium

LOCAL / LOW complexity

Affected Products (1)

Pulp

Affected Vendors

Pulpproject

References (18)

Issue Tracking http://pkgs.fedoraproject.org/cgit/rpms/pulp.git/tree/pulp.spec#n317

Issue Tracking http://pkgs.fedoraproject.org/cgit/rpms/pulp.git/tree/pulp.spec#n620

Mailing List http://www.openwall.com/lists/oss-security/2016/05/20/1

https://access.redhat.com/errata/RHBA-2016:1501

Issue Tracking https://bugzilla.redhat.com/attachment.cgi?id=1146522

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1326251

Issue Tracking https://github.com/pulp/pulp/blob/master/pulp.spec#L473-L486

Issue Tracking https://github.com/pulp/pulp/blob/master/pulp.spec#L894-L903

Patch https://pulp.plan.io/issues/1837