Bug 1598928 (CVE-2018-10917) - CVE-2018-10917 pulp: Improper path parsing leads to overwriting of iso repositories
Summary: CVE-2018-10917 pulp: Improper path parsing leads to overwriting of iso reposi...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2018-10917
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1611032 1616079 1640223
Blocks: 1598930
TreeView+ depends on / blocked
 
Reported: 2018-07-06 21:28 UTC by Pedro Sampaio
Modified: 2021-02-17 00:00 UTC (History)
24 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A path traversal flaw was found in the ISO repository plugin for pulp. An attacker, with access to a repository feeding pulp can carefully craft his repository to overwrite arbitrary files owned by the Apache webserver.
Clone Of:
Environment:
Last Closed: 2019-06-10 10:32:03 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2019:1222 0 None None None 2019-05-14 12:36:08 UTC

Description Pedro Sampaio 2018-07-06 21:28:18 UTC 
A flaw was found in pulp 2.16.x and possibly older. A malicious user or a malicious iso feed repository can write to locations accessible to the ‘apache’ user. This may lead to overwrite of published content on other iso repositories.
Comment 1 Doran Moppert 2018-07-17 04:35:03 UTC 
Statement:

Red Hat Enterprise Virtualization Hypervisor includes only selected components of pulp, which are not affected by this flaw.
Comment 4 Richard Maciel Costa 2018-08-06 23:50:31 UTC 
Acknowledgments:

Name: Simon Baatz (Telekom Deutschland GmbH)
Comment 5 Richard Maciel Costa 2018-08-14 21:51:42 UTC 
Created pulp tracking bugs for this issue:

Affects: fedora-all [bug 1616079]
Comment 8 Riccardo Schirone 2018-10-17 14:34:45 UTC 
Red Hat Update Infrastructure (RHUI) does not ship ISO content so the vulnerability cannot be triggered during regular usage of rhui-manager. However a user could still run (or be tricked into running) pulp commands to trigger the vulnerability on the Red Hat Update Appliance (RHUA).
Comment 12 errata-xmlrpc 2019-05-14 12:36:07 UTC 
This issue has been addressed in the following products:

  Red Hat Satellite 6.5 for RHEL 7

Via RHSA-2019:1222 https://access.redhat.com/errata/RHSA-2019:1222
Note You need to log in before you can comment on or make changes to this bug.