REDHAT-BUG-1326251: Low severity Pulp Pulp vulnerability
It was found that spec file generating RSA keys, used for authenticating messages between server and consumers, as post installation step does this in world-readable directories for a brief moment.
Vulnerable code:
https://github.com/pulp/pulp/blob/master/pulp.spec#L473-L486 https://github.com/pulp/pulp/blob/master/pulp.spec#L894-L903
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1326251?
The severity of REDHAT-BUG-1326251 is considered medium due to the potential exposure of sensitive RSA keys in world-readable directories.
How do I fix REDHAT-BUG-1326251?
To fix REDHAT-BUG-1326251, ensure that RSA keys are generated in secure, non-world-readable directories during the post-installation steps.
What software is affected by REDHAT-BUG-1326251?
REDHAT-BUG-1326251 affects the Pulp software, particularly during its installation process.
Can REDHAT-BUG-1326251 lead to security breaches?
Yes, REDHAT-BUG-1326251 can potentially lead to security breaches if the generated RSA keys are accessed by unauthorized users.
When was REDHAT-BUG-1326251 reported?
REDHAT-BUG-1326251 was reported due to concerns over insecure key generation practices during the installation of Pulp.