| Summary: | CVE-2016-3107 pulp: Node certificate containing private key stored in world-readable file | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Adam Mariš <amaris> | ||||||
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> | ||||||
| Status: | CLOSED ERRATA | QA Contact: | |||||||
| Severity: | medium | Docs Contact: | |||||||
| Priority: | medium | ||||||||
| Version: | unspecified | CC: | bkearney, bmbouter, cbillett, daviddavis, dkliban, ggainey, ipanova, jcline, jmatthew, mhrivnak, mmccune, ohadlevy, pcreech, rbarlow, rchan, sean.myers, security-response-team, tjay, tlestach, tsanders, ttereshc | ||||||
| Target Milestone: | --- | Keywords: | Security | ||||||
| Target Release: | --- | ||||||||
| Hardware: | All | ||||||||
| OS: | Linux | ||||||||
| Whiteboard: | |||||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||||
| Doc Text: |
It was found that the private key for the node certificate was contained in a world-readable file. A local user could possibly use this flaw to gain access to the private key information in the file.
|
Story Points: | --- | ||||||
| Clone Of: | Environment: | ||||||||
| Last Closed: | 2016-09-19 19:02:37 UTC | Type: | --- | ||||||
| Regression: | --- | Mount Type: | --- | ||||||
| Documentation: | --- | CRM: | |||||||
| Verified Versions: | Category: | --- | |||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||
| Bug Depends On: | 1326913, 1326919 | ||||||||
| Bug Blocks: | 1325942 | ||||||||
| Attachments: |
|
||||||||
|
Description
Adam Mariš
2016-04-11 12:41:55 UTC
Acknowledgments: Name: Randy Barlow (Red Hat), Jeremy Cline (Red Hat) Created attachment 1145987 [details]
Proposed patch
Created attachment 1146471 [details]
Proposed patch
I am amending the proposed patch to use the -Z flag on mv, and to credit jcline in the commit message for independently reporting the issue.
This issue is filed upstream as #1833 and is fixed by PR #2529: https://pulp.plan.io/issues/1833 https://github.com/pulp/pulp/pull/2529 The Pulp upstream bug status is at CLOSED - WORKSFORME. Updating the external tracker on this bug. The Pulp upstream bug priority is at Low. Updating the external tracker on this bug. This issue has been addressed in the following products: Red Hat Satellite 6.2 Via RHSA-2016:1501 |