Bug 1598928 (CVE-2018-10917) - CVE-2018-10917 pulp: Improper path parsing leads to overwriting of iso repositories
Summary: CVE-2018-10917 pulp: Improper path parsing leads to overwriting of iso reposi...
Status: NEW
Alias: CVE-2018-10917
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=moderate,public=20180814:2150,...
Keywords: Security
Depends On: 1616079 1640223 1611032
Blocks: 1598930
TreeView+ depends on / blocked
 
Reported: 2018-07-06 21:28 UTC by Pedro Sampaio
Modified: 2019-05-14 12:36 UTC (History)
24 users (show)

(edit)
A path traversal flaw was found in the ISO repository plugin for pulp. An attacker, with access to a repository feeding pulp can carefully craft his repository to overwrite arbitrary files owned by the Apache webserver.
Clone Of:
(edit)
Last Closed:


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2019:1222 None None None 2019-05-14 12:36 UTC

Description Pedro Sampaio 2018-07-06 21:28:18 UTC
A flaw was found in pulp 2.16.x and possibly older. A malicious user or a malicious iso feed repository can write to locations accessible to the ‘apache’ user. This may lead to overwrite of published content on other iso repositories.

Comment 1 Doran Moppert 2018-07-17 04:35:03 UTC
Statement:

Red Hat Enterprise Virtualization Hypervisor includes only selected components of pulp, which are not affected by this flaw.

Comment 4 Richard Maciel Costa 2018-08-06 23:50:31 UTC
Acknowledgments:

Name: Simon Baatz (Telekom Deutschland GmbH)

Comment 5 Richard Maciel Costa 2018-08-14 21:51:42 UTC
Created pulp tracking bugs for this issue:

Affects: fedora-all [bug 1616079]

Comment 8 Riccardo Schirone 2018-10-17 14:34:45 UTC
Red Hat Update Infrastructure (RHUI) does not ship ISO content so the vulnerability cannot be triggered during regular usage of rhui-manager. However a user could still run (or be tricked into running) pulp commands to trigger the vulnerability on the Red Hat Update Appliance (RHUA).

Comment 12 errata-xmlrpc 2019-05-14 12:36:07 UTC
This issue has been addressed in the following products:

  Red Hat Satellite 6.5 for RHEL 7

Via RHSA-2019:1222 https://access.redhat.com/errata/RHSA-2019:1222


Note You need to log in before you can comment on or make changes to this bug.