CVE-2013-7450
First published: Tue Apr 19 2016(Updated: )
Versions of Pulp < 2.3.0 distributed the same certificate authority key and certificate to all Pulp users[0]. This CA is used by the /login API call (pulp-admin login uses this call) to generate and sign a client certificate. This client certificate is then used for subsequent API calls. Due to this vulnerability, remote attackers are able to obtain the CA key from the Pulp git repository and use it to generate valid client certificates for any Pulp installations that use the default CA. The Pulp documentation did not emphasize the importance of replacing this CA for production deployments, so there may be users who use this common CA key in production environments. References: <a href="http://seclists.org/oss-sec/2016/q2/99">http://seclists.org/oss-sec/2016/q2/99</a> Upstream fix: <a href="https://github.com/pulp/pulp/pull/627">https://github.com/pulp/pulp/pull/627</a>
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/pulp | <2.3.0 | 2.3.0 |
| Pulpproject Pulp | <=2.2.1-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://seclists.org/oss-sec/2016/q2/99
- https://github.com/pulp/pulp/pull/627
- https://bugzilla.redhat.com/show_bug.cgi?id=1328345
- http://www.openwall.com/lists/oss-security/2016/04/18/11
- http://www.openwall.com/lists/oss-security/2016/04/18/5
- http://www.openwall.com/lists/oss-security/2016/05/20/1
- https://bugzilla.redhat.com/show_bug.cgi?id=1003326
- collector/redhat-bugzilla
- alias/CVE-2013-7450
- collector/nvd-index
- agent/references
- agent/weakness
- agent/severity
- agent/author
- agent/type
- agent/tags
- agent/description
- agent/event
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/remedy
- package-manager/redhat
- vendor/pulpproject
- canonical/pulpproject pulp
- version/pulpproject pulp/2.2.1-1