CVE-2016-3107

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2016-3107
The Node certificate in Pulp before 2.8.3 contains the private key, and is stored in a world-readable file in the "/etc/pki/pulp/nodes/" directory, which allows local users to gain access to sensitive data.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector : AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

2.1 /10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
http://www.openwall.com/lists/oss-security/2016/05/20/1 Mailing List Third Party Advisory
https://access.redhat.com/errata/RHBA-2016:1501
https://bugzilla.redhat.com/attachment.cgi?id=1146471 Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1325930 Issue Tracking
https://pulp.plan.io/issues/1833 Patch Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:pulpproject:pulp:*:*:*:*:*:*:*:*
History

12 Feb 2023, 23:18

Type Values Removed Values Added
References
  • {'url': 'https://access.redhat.com/security/cve/CVE-2016-3107', 'name': 'https://access.redhat.com/security/cve/CVE-2016-3107', 'tags': [], 'refsource': 'MISC'}
Summary It was found that the private key for the node certificate was contained in a world-readable file. A local user could possibly use this flaw to gain access to the private key information in the file. The Node certificate in Pulp before 2.8.3 contains the private key, and is stored in a world-readable file in the "/etc/pki/pulp/nodes/" directory, which allows local users to gain access to sensitive data.

02 Feb 2023, 14:16

Type Values Removed Values Added
Summary The Node certificate in Pulp before 2.8.3 contains the private key, and is stored in a world-readable file in the "/etc/pki/pulp/nodes/" directory, which allows local users to gain access to sensitive data. It was found that the private key for the node certificate was contained in a world-readable file. A local user could possibly use this flaw to gain access to the private key information in the file.
References
  • (MISC) https://access.redhat.com/security/cve/CVE-2016-3107 -
Information

Published : 2017-06-08 18:29

Updated : 2023-12-10 12:15

NVD link : CVE-2016-3107

Mitre link : CVE-2016-3107

CVE.ORG link : CVE-2016-3107

JSON object : View

Products Affected

pulpproject

  • pulp
CWE
CWE-284

Improper Access Control