CVE-2015-5153: High severity pulpcore vulnerability
It is reported by Austin Macdonald that pulp fails to properly remove existing permissions when an object is deleted (e.g. a user account), if an object with the same name is later created it will inherit the previous permissions leading to a potential privilege escalation. Please note that due to the manner in which pulp is used in Satellite6 it is not vulnerable.
Other sources
Pulp does not remove permissions for named objects upon deletion, which allows authenticated users to gain the privileges of a deleted object via creating an object with the same name.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-5153?
CVE-2015-5153 is categorized as a medium severity vulnerability.
How do I fix CVE-2015-5153?
To fix CVE-2015-5153, ensure you apply the latest patches provided by the Pulp project.
What does CVE-2015-5153 allow an attacker to do?
CVE-2015-5153 allows an attacker to potentially escalate privileges due to improper permissions being retained after object deletion.
Which software versions are affected by CVE-2015-5153?
CVE-2015-5153 affects all versions of Pulp prior to the fix for this vulnerability.
What should I do if I cannot apply the fix for CVE-2015-5153 immediately?
If you cannot apply the fix for CVE-2015-5153 immediately, limit the creation of objects with existing names and monitor access logs for any anomalies.