Information disclosure in Pulp - CVE-2016-3696

Vulnerability identifier: #VU10739

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-3696

CWE-ID: CWE-200

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local attacker to obtain potentially sensitive information.

The weakness exists in the pulp-qpid-ssl-cfg script due to creation of the private CA key in a directory that is world-readable for a small amount of time. A local attacker can gain access to the private key information in the file.

Pulp
Red Hat Satellite
Fedora
pulp-ostree
pulp-python
pulp-docker
pulp
pulp-puppet
pulp-rpm

Update to version 2.8.5 or later.

pulp-ostree - update to 1.1.2-1.fc24
pulp-python - update to 1.1.2-1.fc24
pulp-docker - update to 2.0.2-1.fc24
pulp - update to 2.8.6-1.fc24
pulp-puppet - update to 2.8.6-2.fc24
pulp-rpm - update to 2.8.6-2.fc24

• https://docs.pulpproject.org/user-guide/release-notes/2.8.x.html#pulp-2-8-5

• Information disclosure in Pulp
• Red Hat update for Satellite 6.3
• Fedora 24 update for pulp, pulp-docker, pulp-ostree, pulp-puppet, pulp-python, pulp-rpm