CVE-2024-7143

all versions

A flaw was found in the Pulp package. When a role-based access control (RBAC) object in Pulp is set to assign permissions on its c

8.3HIGH

CVE-2018-10917

<= 2.16.0

pulp 2.16.x and possibly older is vulnerable to an improper path parsing. A malicious user or a malicious iso feed repository can

6.8MEDIUM

CVE-2018-1090

< 2.16.2

In Pulp before version 2.16.2, secrets are passed into override_config when triggering a task and then become readable to all user

5.5MEDIUM

CVE-2015-5263

all versions

pulp-consumer-client 2.4.0 through 2.6.3 does not check the server's TLS certificate signatures when retrieving the server's publi

8.1HIGH

CVE-2015-5153

all versions

Pulp does not remove permissions for named objects upon deletion, which allows authenticated users to gain the privileges of a del

8.8HIGH

CVE-2016-3704

<= 2.8.4

Pulp before 2.8.5 uses bash's $RANDOM in an unsafe way to generate passwords.

7.5HIGH

CVE-2016-3696

<= 2.8.4

The pulp-qpid-ssl-cfg script in Pulp before 2.8.5 allows local users to obtain the CA key.

5.5MEDIUM

CVE-2016-3095

<= 2.8.1

server/bin/pulp-gen-ca-certificate in Pulp before 2.8.2 allows local users to read the generated private key.

5.5MEDIUM

CVE-2016-3112

<= 2.8.2-1

client/consumer/cli.py in Pulp before 2.8.3 writes consumer private keys to etc/pki/pulp/consumer/consumer-cert.pem as world-reada

7.5HIGH

CVE-2016-3111

<= 2.8.2-1

pulp.spec in the installation process for Pulp 2.8.3 generates the RSA key pairs used to validate messages between the pulp server

5.5MEDIUM

CVE-2016-3108

<= 2.8.2-1

The pulp-gen-nodes-certificate script in Pulp before 2.8.3 allows local users to leak the keys or write to arbitrary files via a s

7.1HIGH

CVE-2016-3107

<= 2.8.2-1

The Node certificate in Pulp before 2.8.3 contains the private key, and is stored in a world-readable file in the "/etc/pki/pulp/n

5.5MEDIUM

CVE-2016-3106

all versions

Pulp before 2.8.3 creates a temporary directory during CA key generation in an insecure manner.

5.3MEDIUM

CVE-2013-7450

<= 2.2.1-1

Pulp before 2.3.0 uses the same the same certificate authority key and certificate for all installations.

7.5HIGH