CVE-2016-3111

MEDIUM

pulp < 2.8.2-1 - Exposure of Sensitive Information via World-Readable RSA Key Directory

Title source: llm
STIX 2.1

Description

pulp.spec in the installation process for Pulp 2.8.3 generates the RSA key pairs used to validate messages between the pulp server and pulp consumers in a directory that is world-readable before later modifying the permissions, which might allow local users to read the generated RSA keys via reading the key files while the installation process is running.

References (9)

Core 9
Core References
Issue Tracking, Patch, Third Party Advisory x_refsource_misc
http://pkgs.fedoraproject.org/cgit/rpms/pulp.git/tree/pulp.spec#n620
Issue Tracking, Patch, Third Party Advisory x_refsource_misc
http://pkgs.fedoraproject.org/cgit/rpms/pulp.git/tree/pulp.spec#n317
Issue Tracking, Patch x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=1326251
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/attachment.cgi?id=1146522
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHBA-2016:1501
Patch, Vendor Advisory x_refsource_confirm
https://pulp.plan.io/issues/1837
Issue Tracking, Patch, Third Party Advisory x_refsource_confirm
https://github.com/pulp/pulp/blob/master/pulp.spec#L894-L903
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2016/05/20/1
Issue Tracking, Patch, Third Party Advisory x_refsource_confirm
https://github.com/pulp/pulp/blob/master/pulp.spec#L473-L486

Scores

CVSS v3 5.5
EPSS 0.0039
EPSS Percentile 30.9%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-200
Status published
Products (1)
pulpproject/pulp < 2.8.2-1
Published Jun 08, 2017
Tracked Since Feb 18, 2026