PU
Product
Pulp
13
CVEs
0
On KEV
8.3
Max CVSS
0
New 30D
Severity mix
Critical 0High 7Medium 6Low 0
Watch
Add Pulp to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-7143 | 8.3 | Aug 7 | A flaw was found in the Pulp package Affected: All versions, or not specified |
| CVE-2015-5263 | 8.1 | Sep 25 | pulp-consumer-client 2.4.0 through 2.6.3 does not check the server's TLS certificate signatures when retrieving the server's public key upon registration Affected: 2.4.0; 2.4.1; 2.4.2; 2.4.3; 2.4.4; 2.5.0; +7 more |
| CVE-2018-1090 | 7.5 | Jun 18 | In Pulp before version 2.16.2, secrets are passed into override_config when triggering a task and then become readable to all users with read access on the distributor/importer Affected: before 2.16.2 |
| CVE-2016-3704 | 7.5 | Jun 13 | Pulp before 2.8.5 uses bash's $RANDOM in an unsafe way to generate passwords Affected: through 2.8.4 |
| CVE-2016-3112 | 7.5 | Jun 8 | client/consumer/cli.py in Pulp before 2.8.3 writes consumer private keys to etc/pki/pulp/consumer/consumer-cert.pem as world-readable, which allows remote authenticated users to… Affected: through 2.8.2-1 |
| CVE-2013-7450 | 7.5 | Apr 3 | Pulp before 2.3.0 uses the same the same certificate authority key and certificate for all installations Affected: through 2.2.1-1 |
| CVE-2016-3108 | 7.1 | Jun 8 | The pulp-gen-nodes-certificate script in Pulp before 2.8.3 allows local users to leak the keys or write to arbitrary files via a symlink attack Affected: through 2.8.2-1 |
Showing 7