Grinder in Red Hat CloudForms before 1.1 uses world-writable permissions for /var/lib/pulp/cache/grinder/, which allows local users to modify grinder cache files.

Lukas Zapletal of Red Hat reports:

Regular user (somebody with username and password) and a consumer UUID of any system can download the consumer certificate and consume content or modify data without permission to do that.

During an audit of file permissions within CloudForms it was found that the /etc/pulp/pulp.conf is world readable. This file can contain the following sensitive information:

defaultpassword: default password for admin Highly recommend changing the defaultpassword with "pulp-admin user update" [server] ... defaultlogin: admin defaultpassword: CVkiDB/JKHhHp7+PlkfaqizG ... oauthkey: katello oauthsecret: zH9ZXu6JhDwlx9GjshbFaa0Q

This file should not be world readable, it should only be readable by the user/group that pulp runs as.

Pulp in Red Hat CloudForms before 1.1 logs administrative passwords in a world-readable file, which allows local users to read pulp administrative passwords by reading production.log.