pulp.spec in the installation process for Pulp 2.8.3 generates the RSA key pairs used to validate messages between the pulp server and pulp

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• pulpproject pulpup to 2.8.2-1 inclusive

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2024-7143Pulpcore: rbac permissions incorrectly assigned in tasks that create objects
  33Monitor
• CVE-2015-5263pulp-consumer-client 2.4.0 through 2.6.3 does not check the server's TLS certificate signatures when retrieving the server's public key upon
  32Monitor
• CVE-2016-3112client/consumer/cli.py in Pulp before 2.8.3 writes consumer private keys to etc/pki/pulp/consumer/consumer-cert.pem as world-readable, which
  31Monitor
• CVE-2018-1090In Pulp before version 2.16.2, secrets are passed into override_config when triggering a task and then become readable to all users with rea
  30Monitor
• CVE-2013-7450Pulp before 2.3.0 uses the same the same certificate authority key and certificate for all installations.
  30Monitor
• CVE-2016-3108The pulp-gen-nodes-certificate script in Pulp before 2.8.3 allows local users to leak the keys or write to arbitrary files via a symlink att
  28Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

The extension requests broader permissions than its function needs and sends the data it collects out for purposes beyond its stated function.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1{2  "permissions": ["tabs", "<all_urls>"],3  "background": { "service_worker": "analytics.js" }4}

1{2  "permissions": ["activeTab"],3  "host_permissions": ["https://yildiz.example/*"]4}

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.