CVE-2015-5263: High severity pulp project vulnerability
Published Sep 25, 2017
·Updated
pulp-consumer-client 2.4.0 through 2.6.3 does not check the server's TLS certificate signatures when retrieving the server's public key upon registration.
Affected Software
13 affected components
Pulpproject Pulp=2.4.0
Pulpproject Pulp=2.4.1
Pulpproject Pulp=2.4.2
Pulpproject Pulp=2.4.3
Pulpproject Pulp=2.4.4
Pulpproject Pulp=2.5.0
Pulpproject Pulp=2.5.1
Pulpproject Pulp=2.5.2
Pulpproject Pulp=2.5.3
Pulpproject Pulp=2.6.0
Pulpproject Pulp=2.6.1
Pulpproject Pulp=2.6.2
Pulpproject Pulp=2.6.3
Remediation
Event History
Sep 25, 2017
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-5263?
CVE-2015-5263 has a medium severity rating due to its potential impact on secure communications.
2
How do I fix CVE-2015-5263?
To fix CVE-2015-5263, upgrade to Pulp versions 2.6.4 or later, which includes a patch for this vulnerability.
3
What systems are affected by CVE-2015-5263?
CVE-2015-5263 affects Pulp versions 2.4.0 to 2.6.3.
4
What is the risk associated with CVE-2015-5263?
The risk associated with CVE-2015-5263 is that unverified TLS certificates can allow man-in-the-middle attacks.
5
Is CVE-2015-5263 a remote code execution vulnerability?
No, CVE-2015-5263 is not a remote code execution vulnerability; it primarily compromises secure communication.