CVE-2018-1090

pulp: sensitive credentials revealed through the API

Published Jun 18, 2018 CVSS 3.0 · 5.5 Medium EPSS 1.3% KEV · Not listed
Description
In Pulp before version 2.16.2, secrets are passed into override_config when triggering a task and then become readable to all users with read access on the distributor/importer. An attacker with API access can then view these secrets.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2018-11740 In Pulp before version 2.16.2, secrets are passed into override_config when triggering a task and then become readable to all users with read access on the distributor/importer. An attacker with API access can then view these secrets.
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Aug 5, 2024, 3:51 AM
Reserved
Dec 4, 2017, 12:00 AM
Status
Modified
Published
Jun 18, 2018, 2:29 PM
Modified
Jun 17, 2026, 1:50 AM
Severity
Moderate
Public date
Mar 23, 2018, 12:00 AM