CVE-2016-3111

pulp.spec in the installation process for Pulp 2.8.3 generates the RSA key pairs used to validate messages between the pulp server and pulp consumers in a directory that is world-readable before later modifying the permissions, which might allow local users to read the generated RSA keys via reading the key files while the installation process is running.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.5 MEDIUM
LOCAL
LOW
LOW
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
redhatCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 14%
VendorProductVersion
pulpprojectpulp
𝑥
≤ 2.8.2-1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://pkgs.fedoraproject.org/cgit/rpms/pulp.git/tree/pulp.spec#n317
http://pkgs.fedoraproject.org/cgit/rpms/pulp.git/tree/pulp.spec#n620
http://www.openwall.com/lists/oss-security/2016/05/20/1
https://access.redhat.com/errata/RHBA-2016:1501
https://bugzilla.redhat.com/attachment.cgi?id=1146522
https://bugzilla.redhat.com/show_bug.cgi?id=1326251
https://github.com/pulp/pulp/blob/master/pulp.spec#L473-L486
https://github.com/pulp/pulp/blob/master/pulp.spec#L894-L903
https://pulp.plan.io/issues/1837
http://pkgs.fedoraproject.org/cgit/rpms/pulp.git/tree/pulp.spec#n317
http://pkgs.fedoraproject.org/cgit/rpms/pulp.git/tree/pulp.spec#n620
http://www.openwall.com/lists/oss-security/2016/05/20/1
https://access.redhat.com/errata/RHBA-2016:1501
https://bugzilla.redhat.com/attachment.cgi?id=1146522
https://bugzilla.redhat.com/show_bug.cgi?id=1326251
https://github.com/pulp/pulp/blob/master/pulp.spec#L473-L486
https://github.com/pulp/pulp/blob/master/pulp.spec#L894-L903
https://pulp.plan.io/issues/1837