CVE-2016-3107
published 2017-06-08CVE-2016-3107: The Node certificate in Pulp before 2.8.3 contains the private key, and is stored in a world-readable file in the "/etc/pki/pulp/nodes/" directory, which…
PriorityP422medium5.5CVSS 3.0
AVLACLPRLUINSUCHINAN
EPSS
0.20%
10.1th percentile
The Node certificate in Pulp before 2.8.3 contains the private key, and is stored in a world-readable file in the "/etc/pki/pulp/nodes/" directory, which allows local users to gain access to sensitive data.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| pulpproject | pulp | <= 2.8.2-1 | — |
CVSS provenance
nvdv3.05.5MEDIUMCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:P/I:N/A:N
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-v3xg-vpph-2hjg: The Node certificate in Pulp before 2
ghsa_unreviewed·2022-05-14
CVE-2016-3107 [MEDIUM] CWE-284 GHSA-v3xg-vpph-2hjg: The Node certificate in Pulp before 2
The Node certificate in Pulp before 2.8.3 contains the private key, and is stored in a world-readable file in the "/etc/pki/pulp/nodes/" directory, which allows local users to gain access to sensitive data.
Red Hat
pulp: Node certificate containing private key stored in world-readable file
vendor_redhat·2016-04-13·CVSS 5.5
CVE-2016-3107 [MEDIUM] CWE-732 pulp: Node certificate containing private key stored in world-readable file
pulp: Node certificate containing private key stored in world-readable file
The Node certificate in Pulp before 2.8.3 contains the private key, and is stored in a world-readable file in the "/etc/pki/pulp/nodes/" directory, which allows local users to gain access to sensitive data.
It was found that the private key for the node certificate was contained in a world-readable file. A local user could possibly use this flaw to gain access to the private key information in the file.
No detection rules found.
No public exploits indexed.
http://www.openwall.com/lists/oss-security/2016/05/20/1https://access.redhat.com/errata/RHBA-2016:1501https://bugzilla.redhat.com/attachment.cgi?id=1146471https://bugzilla.redhat.com/show_bug.cgi?id=1325930https://pulp.plan.io/issues/1833http://www.openwall.com/lists/oss-security/2016/05/20/1https://access.redhat.com/errata/RHBA-2016:1501https://bugzilla.redhat.com/attachment.cgi?id=1146471https://bugzilla.redhat.com/show_bug.cgi?id=1325930https://pulp.plan.io/issues/1833
2017-06-08
Published