| Summary: | CVE-2016-3112 pulp: Agent certificate containing private key is stored in world-readable file | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Adam Mariš <amaris> | ||||||
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> | ||||||
| Status: | CLOSED ERRATA | QA Contact: | |||||||
| Severity: | medium | Docs Contact: | |||||||
| Priority: | medium | ||||||||
| Version: | unspecified | CC: | bkearney, cbillett, jcline, jmatthew, mmccune, ohadlevy, rbarlow, sean.myers, security-response-team, tjay, tlestach, tsanders | ||||||
| Target Milestone: | --- | Keywords: | Security | ||||||
| Target Release: | --- | ||||||||
| Hardware: | All | ||||||||
| OS: | Linux | ||||||||
| Whiteboard: | |||||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||||
| Doc Text: |
It was found that the private key for the agent certificate was contained in a world-readable file. A local user could possibly use this flaw to gain access to the private key information in the file.
|
Story Points: | --- | ||||||
| Clone Of: | Environment: | ||||||||
| Last Closed: | 2016-09-19 19:02:56 UTC | Type: | --- | ||||||
| Regression: | --- | Mount Type: | --- | ||||||
| Documentation: | --- | CRM: | |||||||
| Verified Versions: | Category: | --- | |||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||
| Bug Depends On: | 1326913, 1326919 | ||||||||
| Bug Blocks: | 1325942 | ||||||||
| Attachments: |
|
||||||||
|
Description
Adam Mariš
2016-04-12 08:53:59 UTC
Acknowledgments: Name: Jeremy Cline (Red Hat) Created attachment 1146527 [details]
Proposed patch
This fixes the issue where new certificates and keys are written with 644 permissions, but it doesn't do anything for all the keys and certificates that already exist.
From a security perspective, the current proposed patch seems OK, but I believe this code needs to be able to work in Python 2.4 (RHEL 5) which does not have the with statement available. Created attachment 1146538 [details]
python2.4-compatible patch
This patch works with Python 2.4 which is a requirement, as Randy noted. Thanks, Randy!
This patch looks good to me, thanks jcline! This issue has been addressed in the following products: Red Hat Satellite 6.2 Via RHSA-2016:1501 |