| Summary: | CVE-2016-3108 pulp: Insecure temporary file used when generating certificate for Pulp Nodes | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Adam Mariš <amaris> | ||||||
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> | ||||||
| Status: | CLOSED ERRATA | QA Contact: | |||||||
| Severity: | medium | Docs Contact: | |||||||
| Priority: | medium | ||||||||
| Version: | unspecified | CC: | bkearney, bmbouter, cbillett, daviddavis, dkliban, ggainey, ipanova, jcline, jmatthew, mhrivnak, mmccune, ohadlevy, pcreech, rbarlow, rchan, sean.myers, security-response-team, tjay, tlestach, tsanders, ttereshc | ||||||
| Target Milestone: | --- | Keywords: | Security | ||||||
| Target Release: | --- | ||||||||
| Hardware: | All | ||||||||
| OS: | Linux | ||||||||
| Whiteboard: | |||||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||||
| Doc Text: |
It was found that the private key for the node certificate was contained in a world-readable temporary file. A local user could possibly use this flaw to gain access to the private key information in the temporary file.
|
Story Points: | --- | ||||||
| Clone Of: | Environment: | ||||||||
| Last Closed: | 2016-09-19 19:02:46 UTC | Type: | --- | ||||||
| Regression: | --- | Mount Type: | --- | ||||||
| Documentation: | --- | CRM: | |||||||
| Verified Versions: | Category: | --- | |||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||
| Bug Depends On: | 1326913, 1326919 | ||||||||
| Bug Blocks: | 1325942 | ||||||||
| Attachments: |
|
||||||||
|
Description
Adam Mariš
2016-04-11 12:53:28 UTC
Acknowledgments: Name: Jeremy Cline (Red Hat), Sander Bos Created attachment 1145990 [details]
Proposed patch
Created attachment 1146475 [details]
Proposed patch
I am attaching a revised version of the patch that removes the unneeded umask statement, and credits jcline in the commit message.
This is reported upstream as #1830 and is fixed by PR #2528: https://pulp.plan.io/issues/1830 https://github.com/pulp/pulp/pull/2528 The Pulp upstream bug status is at CLOSED - WORKSFORME. Updating the external tracker on this bug. The Pulp upstream bug priority is at Low. Updating the external tracker on this bug. This issue has been addressed in the following products: Red Hat Satellite 6.2 Via RHSA-2016:1501 |