Bug 1598928 (CVE-2018-10917)

Summary:	CVE-2018-10917 pulp: Improper path parsing leads to overwriting of iso repositories
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	austin, bbuckingham, bcourt, bizhang, bkearney, bmbouter, bmcclain, dblechte, dfediuck, eedri, ipanova, jortel, mgoldboi, michal.skrivanek, mmccune, mrike, ohadlevy, pcreech, rchan, rcosta, rjerrido, sbonazzo, security-response-team, sherold
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A path traversal flaw was found in the ISO repository plugin for pulp. An attacker, with access to a repository feeding pulp can carefully craft his repository to overwrite arbitrary files owned by the Apache webserver.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-10 10:32:03 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1611032, 1616079, 1640223
Bug Blocks:	1598930

Description Pedro Sampaio 2018-07-06 21:28:18 UTC

A flaw was found in pulp 2.16.x and possibly older. A malicious user or a malicious iso feed repository can write to locations accessible to the ‘apache’ user. This may lead to overwrite of published content on other iso repositories.

Comment 1 Doran Moppert 2018-07-17 04:35:03 UTC

Statement:

Red Hat Enterprise Virtualization Hypervisor includes only selected components of pulp, which are not affected by this flaw.

Comment 4 Richard Maciel Costa 2018-08-06 23:50:31 UTC

Acknowledgments:

Name: Simon Baatz (Telekom Deutschland GmbH)

Comment 5 Richard Maciel Costa 2018-08-14 21:51:42 UTC

Created pulp tracking bugs for this issue:

Affects: fedora-all [bug 1616079]

Comment 8 Riccardo Schirone 2018-10-17 14:34:45 UTC

Red Hat Update Infrastructure (RHUI) does not ship ISO content so the vulnerability cannot be triggered during regular usage of rhui-manager. However a user could still run (or be tricked into running) pulp commands to trigger the vulnerability on the Red Hat Update Appliance (RHUA).

Comment 12 errata-xmlrpc 2019-05-14 12:36:07 UTC

This issue has been addressed in the following products:

  Red Hat Satellite 6.5 for RHEL 7

Via RHSA-2019:1222 https://access.redhat.com/errata/RHSA-2019:1222