VYPR
← All advisories
Medium severity5.5NVD Advisory· Published Jun 18, 2018· Updated Jun 17, 2026

CVE-2018-1090

CVE-2018-1090

Description

In Pulp before version 2.16.2, secrets are passed into override_config when triggering a task and then become readable to all users with read access on the distributor/importer. An attacker with API access can then view these secrets.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

5
  • Pulpproject/Pulp2 versions
    cpe:2.3:a:pulpproject:pulp:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:pulpproject:pulp:*:*:*:*:*:*:*:*range: <2.16.2
    • (no CPE)range: <2.16.2
  • Fedoraproject/Fedora
    cpe:2.3:o:fedoraproject:fedora:-:*:*:*:*:*:*:*
  • Red Hat/Satellite
    cpe:2.3:a:redhat:satellite:6.4:*:*:*:*:*:*:*
  • Pulpy/Pulpyllm-fuzzy
    Range: <2.16.2

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.