REDHAT-BUG-2300125: Medium severity Pulp Pulp vulnerability
When an RBAC object in Pulp is set to assign perms on its creation it uses the AutoAddObjPermsMixin, typically the method addrolesforobjectcreator. This method finds the object creator by checking the current authenticated user. For objects that are created within a task this current user is set by the first user with any perms on the task object. This means the oldest user with model/domain-level task perms will always be set to the current user of a task even if they didn't dispatch the task. Thus all objects created in tasks will have their permissions assigned to this oldest user, and the creating user will receive nothing.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2300125?
The severity of REDHAT-BUG-2300125 is classified as medium with a score of 4.
What risks are associated with REDHAT-BUG-2300125?
The risk associated with REDHAT-BUG-2300125 involves improper permission assignment due to the misidentification of object creators during task executions.
How do I fix REDHAT-BUG-2300125?
To fix REDHAT-BUG-2300125, ensure that your Pulp installation is updated to the latest version that addresses this vulnerability.
What is the impact of REDHAT-BUG-2300125 on Pulp?
The impact of REDHAT-BUG-2300125 on Pulp includes potential unauthorized access to roles and permissions if RBAC is improperly configured.
Is REDHAT-BUG-2300125 a critical vulnerability?
No, REDHAT-BUG-2300125 is not classified as a critical vulnerability; it has a medium severity rating.