Information disclosure in Pulp - CVE-2016-3704

Vulnerability identifier: #VU10741

CSH Severity: Low

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-3704

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The weakness exists due to unsafe use of Bash's $RANDOM that generates a NSS DB password and seed resulting in insufficient randomness. A remote attacker can potentially guess the seed used given enough time and compute resources.

Pulp
Red Hat Satellite
Fedora
pulp-ostree
pulp-python
pulp-docker
pulp
pulp-puppet
pulp-rpm

Update to version 2.8.5.

pulp-ostree - update to 1.1.2-1.fc24
pulp-python - update to 1.1.2-1.fc24
pulp-docker - update to 2.0.2-1.fc24
pulp - update to 2.8.6-1.fc24
pulp-puppet - update to 2.8.6-2.fc24
pulp-rpm - update to 2.8.6-2.fc24

• https://docs.pulpproject.org/user-guide/release-notes/2.8.x.html#pulp-2-8-5

• Information disclosure in Pulp
• Red Hat update for Satellite 6.3
• Fedora 24 update for pulp, pulp-docker, pulp-ostree, pulp-puppet, pulp-python, pulp-rpm