CVE-2016-3107

Published: Jun 8, 2017Modified: May 13, 2026

5.5

Vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

The Node certificate in Pulp before 2.8.3 contains the private key, and is stored in a world-readable file in the "/etc/pki/pulp/nodes/" directory, which allows local users to gain access to sensitive data.

Affected (1)

Products: Pulpproject: Pulp

Pulpproject

1 product

Pulp

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Pulpproject Pulp	Up to 2.8.2-1

Related CWEs

CWE-284

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (10)

http://www.openwall.com/lists/oss-security/2016/05/20/1

Source: secalert@redhat.com

Mailing ListThird Party Advisory

https://access.redhat.com/errata/RHBA-2016:1501

Source: secalert@redhat.com

https://bugzilla.redhat.com/attachment.cgi?id=1146471

Source: secalert@redhat.com

Issue Tracking

https://bugzilla.redhat.com/show_bug.cgi?id=1325930

Source: secalert@redhat.com

Issue Tracking

https://pulp.plan.io/issues/1833

Source: secalert@redhat.com

PatchVendor Advisory

http://www.openwall.com/lists/oss-security/2016/05/20/1