Project

Profile

Help

Issue #3411

Document Implications that Pulp2 does not support metalink for rpm syncing

Added by bmbouter about 1 year ago. Updated 5 days ago.

Status:
CLOSED - CURRENTRELEASE
Priority:
Normal
Assignee:
Category:
-
Sprint/Milestone:
-
Severity:
2. Medium
Version:
Platform Release:
2.15.3
Blocks Release:
OS:
Backwards Incompatible:
No
Triaged:
Yes
Groomed:
No
Sprint Candidate:
No
Tags:
Documentation, Easy Fix, Pulp 2
QA Contact:
Complexity:
Smash Test:
Verified:
No
Verification Required:
No
Sprint:
Sprint 33

Description

Pulp2 does not support metalink which means that it is vulnerable to a malicious mirror replay attack whereby old packages are delivered even though there are newer packages available in the mirror network.

The recommended fix is to:
1. Clearly state that pulp_rpm does not support metalink.
2. Add a warning that states the part about that talks about a malicious mirror replay attack and links to https://patrick.uiterwijk.org/blog/2018/2/23/fedora-package-delivery-security for more details.

I am reporting on behalf of a user who reported this to me privately.

Associated revisions

Revision 8bffe902 View on GitHub
Added by bmbouter about 1 year ago

Adds metalink clarification

https://pulp.plan.io/issues/3411
closes #3411

(cherry picked from commit ef87f564c48ca7bcf18e7510373a3b528775f016)

Revision 725b0a53 View on GitHub
Added by bmbouter about 1 year ago

Metalink clarification

https://pulp.plan.io/issues/3411
re #3411

(cherry picked from commit a91f71df89a83aa4b80334b27b1410e59dc1b97f)

History

#1 Updated by bmbouter about 1 year ago

  • Tags Easy Fix added

+1 to adding this to the sprint. It's an easyfix for the docs change.

#2 Updated by dalley about 1 year ago

  • Sprint/Milestone set to 56
  • Triaged changed from No to Yes

#3 Updated by bmbouter about 1 year ago

  • Status changed from NEW to ASSIGNED
  • Assignee set to bmbouter

#4 Updated by bmbouter about 1 year ago

  • Status changed from ASSIGNED to POST

#5 Updated by bmbouter about 1 year ago

  • Status changed from POST to MODIFIED

#6 Updated by bmbouter about 1 year ago

  • Platform Release set to 2.15.3

#7 Updated by bmbouter about 1 year ago

  • Sprint set to Sprint 33

#8 Updated by bmbouter about 1 year ago

  • Sprint/Milestone deleted (56)

#9 Updated by bmbouter about 1 year ago

#10 Updated by bmbouter about 1 year ago

  • Status changed from MODIFIED to ON_QA

#11 Updated by bmbouter about 1 year ago

  • Status changed from ON_QA to CLOSED - CURRENTRELEASE

#12 Updated by bmbouter 5 days ago

  • Tags Pulp 2 added

Please register to edit this issue

Also available in: Atom PDF