Actions
Issue #1834
closed
CVE-2016-3112: Pulp consumer private keys are world-readable
Start date:
Due date:
Estimated time:
Severity:
1. Low
Version:
Platform Release:
2.8.3
OS:
Triaged:
Yes
Groomed:
No
Sprint Candidate:
No
Tags:
Pulp 2
Sprint:
Quarter:
Description
Pulp consumers write the certificate and private key issued by the Pulp server's registration process to /etc/pki/pulp/consumer/consumer-cert.pem with 644 permissions, which allowed anyone on the host to read the private key.
This means a non-privileged user on the host could authenticate with the Pulp server as the consumer.
Actions
.
Create consumer private keys with 600 permissions (CVE-2016-3112)
Prior to this commit, consumers wrote the certificate and private key issued by the Pulp server's registration process to /etc/pki/pulp/consumer/consumer-cert.pem with 644 permissions, which allowed anyone on the host to read the private key. This ensures the file is written with 600 permissions.
https://pulp.plan.io/issues/1834
fixes #1834