CVE-2018-10917: Path Traversal
First published: Fri Jul 06 2018(Updated: )
## Withdrawn Advisory This advisory has been withdrawn because the package [pulpcore](https://pypi.org/project/pulpcore/) deals with pulp 3 only. This advisory concerns [pulp 2](https://github.com/pulp/pulp), which is not in a [supported ecosystem](https://github.com/github/advisory-database/blob/main/README.md#supported-ecosystems). ## Original Description pulp 2.16.x and possibly older is vulnerable to an improper path parsing. A malicious user or a malicious iso feed repository can write to locations accessible to the 'apache' user. This may lead to overwrite of published content on other iso repositories.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| pip/pulpcore | <=2.16 | |
| Pulpproject Pulp | <=2.16.0 | |
| Pulpproject Pulp | =2.16.1 | |
| Pulpproject Pulp | =2.16.2 | |
| Pulpproject Pulp | =2.16.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2018-10917
- https://access.redhat.com/errata/RHSA-2019:1222
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10917
- https://access.redhat.com/errata/RHEA-2019:1283
- https://access.redhat.com/security/cve/CVE-2018-10917
- https://bugzilla.redhat.com/show_bug.cgi?id=1598928
- https://github.com/advisories/GHSA-574p-6fw4-4hw8 (Advisory)
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1616079
Frequently Asked Questions
What is the vulnerability ID for this advisory?
The vulnerability ID for this advisory is CVE-2018-10917.
What is the severity of CVE-2018-10917?
The severity of CVE-2018-10917 is medium with a CVSS score of 6.5.
What software is affected by CVE-2018-10917?
The software affected by CVE-2018-10917 includes pulpcore versions 2.16.0, 2.16.1, and 2.16.2.
How can I fix CVE-2018-10917?
To fix CVE-2018-10917, it is recommended to update to a version of pulpcore that is not affected by the vulnerability.
Where can I find more information about CVE-2018-10917?
More information about CVE-2018-10917 can be found in the following references: [Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=1616079), [Red Hat Advisory](https://access.redhat.com/errata/RHSA-2019:1222), [Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=1598928).
- collector/github-advisory-latest
- alias/GHSA-574p-6fw4-4hw8
- alias/CVE-2018-10917
- collector/github-advisory
- collector/nvd-index
- collector/nvd-cve
- agent/author
- agent/type
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- agent/weakness
- agent/severity
- agent/references
- agent/tags
- agent/description
- agent/event
- collector/mitre-cve
- source/MITRE
- package-manager/pip
- vendor/pulpproject
- canonical/pulpproject pulp
- version/pulpproject pulp/2.16.0
- version/pulpproject pulp/2.16.1
- version/pulpproject pulp/2.16.2
- version/pulpproject pulp/2.16.4