PU
Product
Pulp
13
CVEs
0
On KEV
8.3
Max CVSS
0
New 30D
Severity mix
Critical 0High 7Medium 6Low 0
Watch
Add Pulp to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-7143 | 8.3 | Aug 7 | A flaw was found in the Pulp package Affected: All versions, or not specified |
| CVE-2015-5263 | 8.1 | Sep 25 | pulp-consumer-client 2.4.0 through 2.6.3 does not check the server's TLS certificate signatures when retrieving the server's public key upon registration Affected: 2.4.0; 2.4.1; 2.4.2; 2.4.3; 2.4.4; 2.5.0; +7 more |
| CVE-2018-1090 | 7.5 | Jun 18 | In Pulp before version 2.16.2, secrets are passed into override_config when triggering a task and then become readable to all users with read access on the distributor/importer Affected: before 2.16.2 |
| CVE-2016-3704 | 7.5 | Jun 13 | Pulp before 2.8.5 uses bash's $RANDOM in an unsafe way to generate passwords Affected: through 2.8.4 |
| CVE-2016-3112 | 7.5 | Jun 8 | client/consumer/cli.py in Pulp before 2.8.3 writes consumer private keys to etc/pki/pulp/consumer/consumer-cert.pem as world-readable, which allows remote authenticated users to… Affected: through 2.8.2-1 |
| CVE-2013-7450 | 7.5 | Apr 3 | Pulp before 2.3.0 uses the same the same certificate authority key and certificate for all installations Affected: through 2.2.1-1 |
| CVE-2016-3108 | 7.1 | Jun 8 | The pulp-gen-nodes-certificate script in Pulp before 2.8.3 allows local users to leak the keys or write to arbitrary files via a symlink attack Affected: through 2.8.2-1 |
| CVE-2018-10917 | 6.5 | Aug 15 | pulp 2.16.x and possibly older is vulnerable to an improper path parsing Affected: through 2.16.0; 2.16.1; 2.16.2; 2.16.4 |
| CVE-2016-3696 | 5.5 | Jun 13 | The pulp-qpid-ssl-cfg script in Pulp before 2.8.5 allows local users to obtain the CA key Affected: through 2.8.4 |
| CVE-2016-3095 | 5.5 | Jun 8 | server/bin/pulp-gen-ca-certificate in Pulp before 2.8.2 allows local users to read the generated private key Affected: through 2.8.1 |
| CVE-2016-3111 | 5.5 | Jun 8 | pulp.spec in the installation process for Pulp 2.8.3 generates the RSA key pairs used to validate messages between the pulp server and pulp consumers in a directory that is… Affected: through 2.8.2-1 |
| CVE-2016-3107 | 5.5 | Jun 8 | The Node certificate in Pulp before 2.8.3 contains the private key, and is stored in a world-readable file in the "/etc/pki/pulp/nodes/" directory, which allows local users to… Affected: through 2.8.2-1 |
| CVE-2016-3106 | 5.3 | Apr 13 | Pulp before 2.8.3 creates a temporary directory during CA key generation in an insecure manner Affected: 2.8.2-1 |
Showing 13