Bug 1598928 (CVE-2018-10917)

Summary: CVE-2018-10917 pulp: Improper path parsing leads to overwriting of iso repositories
Product: [Other] Security Response Reporter: Pedro Sampaio <psampaio>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: austin, bbuckingham, bcourt, bizhang, bkearney, bmbouter, bmcclain, dblechte, dfediuck, eedri, ipanova, jortel, mgoldboi, michal.skrivanek, mmccune, mrike, ohadlevy, pcreech, rchan, rcosta, rjerrido, sbonazzo, security-response-team, sherold
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
A path traversal flaw was found in the ISO repository plugin for pulp. An attacker, with access to a repository feeding pulp can carefully craft his repository to overwrite arbitrary files owned by the Apache webserver.
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-06-10 10:32:03 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1616079, 1611032, 1640223    
Bug Blocks: 1598930    

Description Pedro Sampaio 2018-07-06 21:28:18 UTC
A flaw was found in pulp 2.16.x and possibly older. A malicious user or a malicious iso feed repository can write to locations accessible to the ‘apache’ user. This may lead to overwrite of published content on other iso repositories.

Comment 1 Doran Moppert 2018-07-17 04:35:03 UTC
Statement:

Red Hat Enterprise Virtualization Hypervisor includes only selected components of pulp, which are not affected by this flaw.

Comment 4 Richard Maciel Costa 2018-08-06 23:50:31 UTC
Acknowledgments:

Name: Simon Baatz (Telekom Deutschland GmbH)

Comment 5 Richard Maciel Costa 2018-08-14 21:51:42 UTC
Created pulp tracking bugs for this issue:

Affects: fedora-all [bug 1616079]

Comment 8 Riccardo Schirone 2018-10-17 14:34:45 UTC
Red Hat Update Infrastructure (RHUI) does not ship ISO content so the vulnerability cannot be triggered during regular usage of rhui-manager. However a user could still run (or be tricked into running) pulp commands to trigger the vulnerability on the Red Hat Update Appliance (RHUA).

Comment 12 errata-xmlrpc 2019-05-14 12:36:07 UTC
This issue has been addressed in the following products:

  Red Hat Satellite 6.5 for RHEL 7

Via RHSA-2019:1222 https://access.redhat.com/errata/RHSA-2019:1222