CVE-2016-3111

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

pulp.spec in the installation process for Pulp 2.8.3 generates the RSA key pairs used to validate messages between the pulp server and pulp consumers in a directory that is world-readable before later modifying the permissions, which might allow local users to read the generated RSA keys via reading the key files while the installation process is running.

Metrics

CVSS 3.0 5.5/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://pkgs.fedoraproject.org/cgit/rpms/pulp.git/tree/pulp.spec#n317Issue Tracking, Patch, Third Party Advisory
http://pkgs.fedoraproject.org/cgit/rpms/pulp.git/tree/pulp.spec#n620Issue Tracking, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/05/20/1Mailing List, Third Party Advisory
https://access.redhat.com/errata/RHBA-2016:1501
https://bugzilla.redhat.com/attachment.cgi?id=1146522Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1326251Issue Tracking, Patch
https://github.com/pulp/pulp/blob/master/pulp.spec#L473-L486Issue Tracking, Patch, Third Party Advisory
https://github.com/pulp/pulp/blob/master/pulp.spec#L894-L903Issue Tracking, Patch, Third Party Advisory
https://pulp.plan.io/issues/1837Patch, Vendor Advisory
http://pkgs.fedoraproject.org/cgit/rpms/pulp.git/tree/pulp.spec#n317Issue Tracking, Patch, Third Party Advisory
http://pkgs.fedoraproject.org/cgit/rpms/pulp.git/tree/pulp.spec#n620Issue Tracking, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/05/20/1Mailing List, Third Party Advisory
https://access.redhat.com/errata/RHBA-2016:1501
https://bugzilla.redhat.com/attachment.cgi?id=1146522Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1326251Issue Tracking, Patch
https://github.com/pulp/pulp/blob/master/pulp.spec#L473-L486Issue Tracking, Patch, Third Party Advisory
https://github.com/pulp/pulp/blob/master/pulp.spec#L894-L903Issue Tracking, Patch, Third Party Advisory
https://pulp.plan.io/issues/1837Patch, Vendor Advisory

Timeline

Published: Jun 8, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-31127.5client/consumer/cli.py in Pulp before 2.8.3 writes consumer private keys to etc/pki/pulp/consumer/consumer-cert.pem as world-readable, which CVE-2016-31136.1Cross-site scripting (XSS) vulnerability in ovirt-engine allows remote attackers to inject arbitrary web script or HTML.CVE-2016-31146.5Kallithea before 0.3.2 allows remote authenticated users to edit or delete open pull requests or delete comments by leveraging read access.CVE-2016-31156.4Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to bypass intended she CVE-2016-31166.4CRLF injection vulnerability in Dropbear SSH before 2016.72 allows remote authenticated users to bypass intended shell-command restrictions CVE-2016-31186.5CRLF injection vulnerability in CA API Gateway (formerly Layer7 API Gateway) 7.1 before 7.1.04, 8.0 through 8.3 before 8.3.01, and 8.4 befor CVE-2016-31195.3The process_db_args function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5 CVE-2016-31206.5The validate_as_request function in kdc_util.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.13.6 and 1.4.x bef CVE-2016-31245.3The sanitycheck module in SimpleSAMLphp before 1.14.1 allows remote attackers to learn the PHP version on the system via unspecified vectors CVE-2016-31257.5The mod_tls module in ProFTPD before 1.3.5b and 1.3.6 before 1.3.6rc2 does not properly handle the TLSDHParamFile directive, which might cau CVE-2016-31266.1Cross-site scripting (XSS) vulnerability in the Management Console in BlackBerry Enterprise Server (BES) 12 before 12.4.1 allows remote atta CVE-2016-31277.5An information disclosure vulnerability in the logging implementation of BlackBerry Good Control Server versions earlier than 2.3.53.62 allo