REDHAT-BUG-2544606: Medium severity Pulp Project pulp-rpm vulnerability
Publish copies the addon id and variant id from .treeinfo into addonid and variantid with no path check (pulprpm/app/kickstart/treeinfo.py). RpmPublication.populate() then calls os.mkdir(name) with that string (pulprpm/app/tasks/publishing.py) and writes the synced metadata and packages under that name. os.mkdir does not create missing parents, and it fails when the path already exists, so an existing file is not replaced. A ".." component or an absolute id whose parent exists leaves the worker temporary directory. The same code runs for any repository version that contains a distribution tree. No extra setting selects it. Introduced with kickstart publishing in 8a8048e2, tag 3.0.0b5, and every stable release from 3.2.0.
Affected Software
Event History
Frequently Asked Questions
Which repository versions can trigger the vulnerable publishing path?
Any repository version that contains a distribution tree can trigger it. No additional setting is required to select this code path.
What metadata values create the path traversal condition?
The condition occurs when the distribution tree's .treeinfo addon ID or variant ID contains a ".." component, or contains an absolute path whose parent already exists. Those values are used as directory names during publication.
Which pulp-rpm releases are affected?
The issue was introduced with kickstart publishing in tag 3.0.0b5. Every stable release from 3.2.0 is affected.