CVE-2018-10917

pulp: Improper path parsing leads to overwriting of iso repositories

Published Aug 15, 2018 CVSS 3.0 · 6.8 Medium EPSS 1.1% KEV · Not listed
Description
pulp 2.16.x and possibly older is vulnerable to an improper path parsing. A malicious user or a malicious iso feed repository can write to locations accessible to the 'apache' user. This may lead to overwrite of published content on other iso repositories.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2022-2518 pulp 2.16.x and possibly older is vulnerable to an improper path parsing. A malicious user or a malicious iso feed repository can write to locations accessible to the 'apache' user. This may lead to overwrite of published content on other iso repositories.
Github GHSA Github GHSA GHSA-574p-6fw4-4hw8 Withdrawn Advisory: Pulp Improper Path Parsing
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Aug 5, 2024, 7:54 AM
Reserved
May 9, 2018, 12:00 AM
Status
Modified
Published
Aug 15, 2018, 5:29 PM
Modified
Jun 17, 2026, 1:34 AM
Severity
Moderate
Public date
Aug 14, 2018, 9:50 PM