CVE-2013-7450: High severity Pulpproject Pulp vulnerability
Pulp before 2.3.0 uses the same the same certificate authority key and certificate for all installations.
Other sources
Versions of Pulp < 2.3.0 distributed the same certificate authority key and certificate to all Pulp users[0]. This CA is used by the /login API call (pulp-admin login uses this call) to generate and sign a client certificate. This client certificate is then used for subsequent API calls.
Due to this vulnerability, remote attackers are able to obtain the CA key from the Pulp git repository and use it to generate valid client certificates for any Pulp installations that use the default CA. The Pulp documentation did not emphasize the importance of replacing this CA for production deployments, so there may be users who use this common CA key in production environments.
References:
http://seclists.org/oss-sec/2016/q2/99
Upstream fix:
https://github.com/pulp/pulp/pull/627
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-7450?
CVE-2013-7450 is considered a high-severity vulnerability due to the potential for man-in-the-middle attacks.
How do I fix CVE-2013-7450?
To fix CVE-2013-7450, upgrade to Pulp version 2.3.0 or later.
What type of vulnerabilities does CVE-2013-7450 represent?
CVE-2013-7450 represents an issue related to improper certificate management leading to insecure communications.
Can CVE-2013-7450 be exploited remotely?
Yes, CVE-2013-7450 can be exploited remotely if an attacker can intercept the traffic.
What versions of Pulp are affected by CVE-2013-7450?
Pulp versions prior to 2.3.0 are affected by CVE-2013-7450.