Pulp vulnerabilities

Pulp does not remove permissions for named objects upon deletion, which allows authenticated users to gain the privileges of a deleted object via creating an object with the same name.

Pulp before 2.8.5 uses bash's $RANDOM in an unsafe way to generate passwords.

In Pulp before version 2.8.3, the consumer private key is written to etc/pki/pulp/consumer/consumer-cert.pem with world-readable permissions. This allows remote authenticated users to obtain the consumer private keys and escalate privileges.

The pulp-gen-nodes-certificate script in Pulp before 2.8.3 allows local users to leak keys or write to arbitrary files via a symlink attack.

Pulp before version 2.3.0 uses the same certificate authority key and certificate for all installations.

A flaw in Pulp as used in Red Hat CloudForms allows a local user to read the administrative password due to world-readable permissions on the pulp.conf configuration file. This information disclosure could enable unauthorized access to sensitive system credentials.