CVE-2016-3108: High severity pulp project vulnerability
It was reported that pulp-gen-nodes-certificate script uses insecurely created temporary files for storing the generated node certificates, allowing local attackers to leak the keys or overwrite arbitrary file via symlink.
Other sources
The pulp-gen-nodes-certificate script in Pulp before 2.8.3 allows local users to leak the keys or write to arbitrary files via a symlink attack.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-3108?
CVE-2016-3108 is considered a medium severity vulnerability due to its potential for local file manipulation and key leakage.
What are the consequences of CVE-2016-3108?
The consequences of CVE-2016-3108 include the risk of local attackers being able to leak sensitive keys or overwrite files due to insecure temporary file handling.
How do I fix CVE-2016-3108?
To fix CVE-2016-3108, upgrade to Pulp version 2.8.3 or later, which addresses the vulnerability.
Which versions of Pulp are affected by CVE-2016-3108?
CVE-2016-3108 affects Pulp versions up to and including 2.8.2-1.
Is CVE-2016-3108 exploited remotely?
No, CVE-2016-3108 requires local access to exploit, as it involves the local manipulation of files.