Unrated severityNVD Advisory· Published Jun 18, 2018· Updated Aug 5, 2024
CVE-2018-1090
CVE-2018-1090
Description
In Pulp before version 2.16.2, secrets are passed into override_config when triggering a task and then become readable to all users with read access on the distributor/importer. An attacker with API access can then view these secrets.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3- access.redhat.com/errata/RHSA-2018:2927mitrevendor-advisoryx_refsource_REDHAT
- bugzilla.redhat.com/show_bug.cgimitrex_refsource_CONFIRM
- pulp.plan.io/issues/3521mitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.