CVE-2018-1090: Infoleak

Published Mar 23, 2018
·
Updated

A flaw was found in Pulp. Importers and distributors have a "lastoverrideconfig" object which is exposed via the API. In several cases, secrets are passed into overrideconfig when triggering a task. If these config items are given, they're stored in lastoverrideconfig and then become readable to all users with read access on the distributor/importer. Since Pulp installations internally have widely shared read-only accounts which allows everyone to freely data mine / build applications on top of our Pulp without administrative hassle, saved credentials might be accidentally revealed through the API to unwanted users.

Other sources

In Pulp before version 2.16.2, secrets are passed into overrideconfig when triggering a task and then become readable to all users with read access on the distributor/importer. An attacker with API access can then view these secrets.

In pulp, secrets are passed into overrideconfig when triggering a task and then become readable to all users with read access on the distributor/importer. An attacker with API access can then view these secrets.

Affected Software

246 affected componentsFixes available
redhat/ansiblerole-insights-client<0:1.5-1.el7
0:1.5-1.el7
redhat/candlepin<0:2.4.8-1.el7
0:2.4.8-1.el7
redhat/foreman<0:1.18.0.37-1.el7
0:1.18.0.37-1.el7
redhat/foreman-bootloaders-redhat<0:201801241201-3.el7
0:201801241201-3.el7
redhat/foreman-installer<1:1.18.0.2-1.el7
1:1.18.0.2-1.el7
redhat/foreman-proxy<0:1.18.0.1-1.el7
0:1.18.0.1-1.el7
redhat/foreman-selinux<0:1.18.0.1-1.el7
0:1.18.0.1-1.el7
redhat/gofer<0:2.12.1-1.el7
0:2.12.1-1.el7
redhat/hfsplus-tools<0:332.14-12.el7
0:332.14-12.el7
redhat/katello<0:3.7.0-8.el7
0:3.7.0-8.el7
redhat/katello-certs-tools<0:2.4.0-2.el7
0:2.4.0-2.el7
redhat/katello-client-bootstrap<0:1.6.0-1.el7
0:1.6.0-1.el7
redhat/katello-installer-base<0:3.7.0.10-1.el7
0:3.7.0.10-1.el7
redhat/katello-selinux<0:3.0.3-2.el7
0:3.0.3-2.el7
redhat/kobo<0:0.5.1-1.el7
0:0.5.1-1.el7
redhat/libstemmer<0:0-2.585svn.el7
0:0-2.585svn.el7
redhat/libwebsockets<0:2.1.0-3.el7
0:2.1.0-3.el7
redhat/liquibase<0:3.1.0-1.el7
0:3.1.0-1.el7
redhat/livecd-tools<1:20.4-1.6.el7
1:20.4-1.6.el7
redhat/mongodb<0:2.6.11-2.el7
0:2.6.11-2.el7
redhat/ostree<0:2017.1-2.atomic.el7
0:2017.1-2.atomic.el7
redhat/pcp-mmvstatsd<0:0.4-1.el7
0:0.4-1.el7
redhat/pulp<0:2.16.4.1-1.el7
0:2.16.4.1-1.el7
redhat/pulp-docker<0:3.1.4.1-1.el7
0:3.1.4.1-1.el7
redhat/pulp-katello<0:1.0.2-5.el7
0:1.0.2-5.el7
redhat/pulp-ostree<0:1.3.0-1.el7
0:1.3.0-1.el7
redhat/pulp-puppet<0:2.16.4-3.el7
0:2.16.4-3.el7
redhat/pulp-rpm<0:2.16.4.1-5.el7
0:2.16.4.1-5.el7
redhat/puppet-agent<0:5.5.0-2.el7
0:5.5.0-2.el7
redhat/puppet-agent-oauth<0:0.5.1-3.el7
0:0.5.1-3.el7
redhat/puppetlabs-stdlib<0:4.2.1-1.20140510git08b00d9.el7
0:4.2.1-1.20140510git08b00d9.el7
redhat/puppetserver<0:5.3.1-1.el7
0:5.3.1-1.el7
redhat/python-amqp<0:2.2.2-3.el7
0:2.2.2-3.el7
redhat/python-anyjson<0:0.3.3-5.el7
0:0.3.3-5.el7
redhat/python-billiard<1:3.5.0.3-3.el7
1:3.5.0.3-3.el7
redhat/python-blinker<0:1.3-2.el7
0:1.3-2.el7
redhat/python-celery<0:4.0.2-4.el7
0:4.0.2-4.el7
redhat/python-crane<0:3.1.1-1.el7
0:3.1.1-1.el7
redhat/python-django<0:1.11.11-1.el7
0:1.11.11-1.el7
redhat/python-flask<1:0.10.1-4.el7
1:0.10.1-4.el7
redhat/python-fpconst<0:0.7.3-12.el7
0:0.7.3-12.el7
redhat/python-gnupg<0:0.3.7-1.el7
0:0.3.7-1.el7
redhat/python-isodate<0:0.5.0-5.pulp.el7
0:0.5.0-5.pulp.el7
redhat/python-itsdangerous<0:0.23-1.el7
0:0.23-1.el7
redhat/python-jinja2<0:2.7.2-2.el7
0:2.7.2-2.el7
redhat/python-kid<0:0.9.6-11.el7
0:0.9.6-11.el7
redhat/python-kombu<1:4.0.2-8.el7
1:4.0.2-8.el7
redhat/python-mongoengine<0:0.10.5-2.el7
0:0.10.5-2.el7
redhat/python-nectar<0:1.5.6-1.el7
0:1.5.6-1.el7
redhat/python-oauth2<0:1.5.211-8.el7
0:1.5.211-8.el7
redhat/python-okaara<0:1.0.32-1.el7
0:1.0.32-1.el7
redhat/python-pymongo<0:3.2-1.el7
0:3.2-1.el7
redhat/python-qpid<0:1.35.0-5.el7
0:1.35.0-5.el7
redhat/python-simplejson<0:3.2.0-1.el7
0:3.2.0-1.el7
redhat/python-twisted-core<0:12.2.0-4.el7
0:12.2.0-4.el7
redhat/python-twisted-web<0:12.1.0-5.el7_2
0:12.1.0-5.el7_2
redhat/python-vine<0:1.1.3-4.el7
0:1.1.3-4.el7
redhat/python-werkzeug<0:0.9.1-1.el7
0:0.9.1-1.el7
redhat/python-zope-interface<0:4.0.5-4.el7
0:4.0.5-4.el7
redhat/qpid-cpp<0:1.36.0-19.el7
0:1.36.0-19.el7
redhat/qpid-dispatch<0:0.8.0-19.el7
0:0.8.0-19.el7
redhat/qpid-proton<0:0.16.0-12.el7
0:0.16.0-12.el7
redhat/redhat-access-insights-puppet<0:0.0.9-3.el7
0:0.0.9-3.el7
redhat/repoview<0:0.6.6-4.el7
0:0.6.6-4.el7
redhat/rubygem-ansi<0:1.4.3-3.el7
0:1.4.3-3.el7
redhat/rubygem-clamp<0:1.1.2-2.el7
0:1.1.2-2.el7
redhat/rubygem-concurrent-ruby<1:1.0.3-6.el7
1:1.0.3-6.el7
redhat/rubygem-facter<0:2.4.1-2.el7
0:2.4.1-2.el7
redhat/rubygem-ffi<0:1.4.0-3.el7
0:1.4.0-3.el7
redhat/rubygem-gssapi<0:1.1.2-4.el7
0:1.1.2-4.el7
redhat/rubygem-hashie<0:2.0.5-5.el7
0:2.0.5-5.el7
redhat/rubygem-highline<0:1.7.8-3.el7
0:1.7.8-3.el7
redhat/rubygem-kafo<0:2.1.0-1.el7
0:2.1.0-1.el7
redhat/rubygem-little-plugger<0:1.1.3-22.el7
0:1.1.3-22.el7
redhat/rubygem-logging<0:2.2.2-1.el7
0:2.2.2-1.el7
redhat/rubygem-mime-types<0:1.19-7.el7
0:1.19-7.el7
redhat/rubygem-netrc<0:0.7.7-9.el7
0:0.7.7-9.el7
redhat/rubygem-newt<0:0.9.6-3.el7
0:0.9.6-3.el7
redhat/rubygem-oauth<0:0.5.4-2.el7
0:0.5.4-2.el7
redhat/rubygem-openscap<0:0.4.7-3.el7
0:0.4.7-3.el7
redhat/rubygem-passenger<0:4.0.18-24.el7
0:4.0.18-24.el7
redhat/rubygem-powerbar<0:1.0.17-2.el7
0:1.0.17-2.el7
redhat/rubygem-rack<1:1.6.4-3.el7
1:1.6.4-3.el7
redhat/rubygem-rack-protection<0:1.5.3-4.el7
0:1.5.3-4.el7
redhat/rubygem-rake<0:0.9.2.2-41.el7
0:0.9.2.2-41.el7
redhat/rubygem-rb-inotify<0:0.9.7-4.el7
0:0.9.7-4.el7
redhat/rubygem-rest-client<0:1.6.7-7.el7
0:1.6.7-7.el7
redhat/rubygem-rkerberos<0:0.1.3-5.el7
0:0.1.3-5.el7
redhat/rubygem-rsec<0:0.4.2-2.el7
0:0.4.2-2.el7
redhat/rubygem-rubyipmi<0:0.10.0-2.el7
0:0.10.0-2.el7
redhat/rubygem-sinatra<1:1.4.7-3.el7
1:1.4.7-3.el7
redhat/rubygem-tilt<0:1.3.7-2.git.0.3b416c9.el7
0:1.3.7-2.git.0.3b416c9.el7
redhat/saslwrapper<0:0.22-5.el7
0:0.22-5.el7
redhat/satellite<0:6.4.0-15.el7
0:6.4.0-15.el7
redhat/satellite-installer<0:6.4.0.7-2.el7
0:6.4.0.7-2.el7
redhat/tfm<0:4.0-3.el7
0:4.0-3.el7
redhat/tfm-ror51<0:1.1-2.el7
0:1.1-2.el7
redhat/tfm-ror51-rubygem-actioncable<0:5.1.6-1.el7
0:5.1.6-1.el7
redhat/tfm-ror51-rubygem-actionmailer<0:5.1.6-1.el7
0:5.1.6-1.el7
redhat/tfm-ror51-rubygem-actionpack<0:5.1.6-1.el7
0:5.1.6-1.el7
redhat/tfm-ror51-rubygem-actionview<0:5.1.6-1.el7
0:5.1.6-1.el7
redhat/tfm-ror51-rubygem-activejob<0:5.1.6-1.el7
0:5.1.6-1.el7
redhat/tfm-ror51-rubygem-activemodel<0:5.1.6-1.el7
0:5.1.6-1.el7
redhat/tfm-ror51-rubygem-activerecord<0:5.1.6-1.el7
0:5.1.6-1.el7
redhat/tfm-ror51-rubygem-activesupport<0:5.1.6-1.el7
0:5.1.6-1.el7
redhat/tfm-ror51-rubygem-arel<0:8.0.0-1.el7
0:8.0.0-1.el7
redhat/tfm-ror51-rubygem-builder<0:3.2.3-1.el7
0:3.2.3-1.el7
redhat/tfm-ror51-rubygem-coffee-rails<0:4.2.2-1.el7
0:4.2.2-1.el7
redhat/tfm-ror51-rubygem-coffee-script<0:2.4.1-1.el7
0:2.4.1-1.el7
redhat/tfm-ror51-rubygem-coffee-script-source<0:1.12.2-1.el7
0:1.12.2-1.el7
redhat/tfm-ror51-rubygem-concurrent-ruby<0:1.0.5-4.el7
0:1.0.5-4.el7
redhat/tfm-ror51-rubygem-crass<0:1.0.2-1.el7
0:1.0.2-1.el7
redhat/tfm-ror51-rubygem-erubi<0:1.7.0-1.el7
0:1.7.0-1.el7
redhat/tfm-ror51-rubygem-execjs<0:2.7.0-1.el7
0:2.7.0-1.el7
redhat/tfm-ror51-rubygem-globalid<0:0.4.1-1.el7
0:0.4.1-1.el7
redhat/tfm-ror51-rubygem-i18n<0:0.9.1-2.el7
0:0.9.1-2.el7
redhat/tfm-ror51-rubygem-loofah<0:2.1.1-2.el7
0:2.1.1-2.el7
redhat/tfm-ror51-rubygem-mail<0:2.7.0-2.el7
0:2.7.0-2.el7
redhat/tfm-ror51-rubygem-mime-types<0:3.1-1.el7
0:3.1-1.el7
redhat/tfm-ror51-rubygem-mime-types-data<0:3.2016.0521-1.el7
0:3.2016.0521-1.el7
redhat/tfm-ror51-rubygem-mustermann<0:1.0.1-1.el7
0:1.0.1-1.el7
redhat/tfm-ror51-rubygem-nio4r<0:2.1.0-1.el7
0:2.1.0-1.el7
redhat/tfm-ror51-rubygem-nokogiri<0:1.8.1-1.el7
0:1.8.1-1.el7
redhat/tfm-ror51-rubygem-rack<0:2.0.3-1.el7
0:2.0.3-1.el7
redhat/tfm-ror51-rubygem-rack-protection<0:2.0.0-1.el7
0:2.0.0-1.el7
redhat/tfm-ror51-rubygem-rack-test<0:0.7.0-1.el7
0:0.7.0-1.el7
redhat/tfm-ror51-rubygem-rails<0:5.1.6-1.el7
0:5.1.6-1.el7
redhat/tfm-ror51-rubygem-rails-dom-testing<0:2.0.3-1.el7
0:2.0.3-1.el7
redhat/tfm-ror51-rubygem-rails-html-sanitizer<0:1.0.3-2.el7
0:1.0.3-2.el7
redhat/tfm-ror51-rubygem-railties<0:5.1.6-1.el7
0:5.1.6-1.el7
redhat/tfm-ror51-rubygem-sinatra<0:2.0.0-1.el7
0:2.0.0-1.el7
redhat/tfm-ror51-rubygem-sprockets<0:3.7.1-1.el7
0:3.7.1-1.el7
redhat/tfm-ror51-rubygem-sprockets-rails<0:3.2.1-1.el7
0:3.2.1-1.el7
redhat/tfm-ror51-rubygem-sqlite3<0:1.3.13-1.el7
0:1.3.13-1.el7
redhat/tfm-ror51-rubygem-thor<0:0.20.0-1.el7
0:0.20.0-1.el7
redhat/tfm-ror51-rubygem-tilt<0:2.0.8-1.el7
0:2.0.8-1.el7
redhat/tfm-ror51-rubygem-turbolinks<0:2.5.4-1.el7
0:2.5.4-1.el7
redhat/tfm-ror51-rubygem-tzinfo<0:1.2.4-2.el7
0:1.2.4-2.el7
redhat/tfm-ror51-rubygem-websocket-driver<0:0.6.5-2.el7
0:0.6.5-2.el7
redhat/tfm-ror51-rubygem-websocket-extensions<0:0.1.2-1.el7
0:0.1.2-1.el7
redhat/tfm-rubygem-addressable<0:2.3.6-5.el7
0:2.3.6-5.el7
redhat/tfm-rubygem-algebrick<0:0.7.3-5.el7
0:0.7.3-5.el7
redhat/tfm-rubygem-ancestry<0:3.0.0-2.el7
0:3.0.0-2.el7
redhat/tfm-rubygem-anemone<0:0.7.2-19.el7
0:0.7.2-19.el7
redhat/tfm-rubygem-angular-rails-templates<1:1.0.2-2.el7
1:1.0.2-2.el7
redhat/tfm-rubygem-apipie-bindings<0:0.2.2-1.el7
0:0.2.2-1.el7
redhat/tfm-rubygem-apipie-params<0:0.0.5-4.el7
0:0.0.5-4.el7
redhat/tfm-rubygem-apipie-rails<0:0.5.7-1.el7
0:0.5.7-1.el7
redhat/tfm-rubygem-audited<0:4.7.0-1.el7
0:4.7.0-1.el7
redhat/tfm-rubygem-autoparse<0:0.3.3-9.el7
0:0.3.3-9.el7
redhat/tfm-rubygem-bastion<0:6.1.11-1.el7
0:6.1.11-1.el7
redhat/tfm-rubygem-clamp<0:1.1.2-2.el7
0:1.1.2-2.el7
redhat/tfm-rubygem-concurrent-ruby-edge<1:0.2.4-1.el7
1:0.2.4-1.el7
redhat/tfm-rubygem-daemons<0:1.2.3-6.el7
0:1.2.3-6.el7
redhat/tfm-rubygem-deacon<0:1.0.0-3.el7
0:1.0.0-3.el7
redhat/tfm-rubygem-deface<0:1.2.0-10.el7
0:1.2.0-10.el7
redhat/tfm-rubygem-diffy<0:3.0.1-5.el7
0:3.0.1-5.el7
redhat/tfm-rubygem-docker-api<0:1.28.0-3.el7
0:1.28.0-3.el7
redhat/tfm-rubygem-dynflow<0:1.0.5.1-1.el7
0:1.0.5.1-1.el7
redhat/tfm-rubygem-excon<0:0.58.0-2.el7
0:0.58.0-2.el7
redhat/tfm-rubygem-extlib<0:0.9.16-5.el7
0:0.9.16-5.el7
redhat/tfm-rubygem-facter<0:2.4.0-5.el7
0:2.4.0-5.el7
redhat/tfm-rubygem-faraday<0:0.9.1-5.el7
0:0.9.1-5.el7
redhat/tfm-rubygem-ffi<0:1.4.0-11.el7
0:1.4.0-11.el7
redhat/tfm-rubygem-fog<0:1.42.1-1.el7
0:1.42.1-1.el7
redhat/tfm-rubygem-fog-aws<0:1.3.0-2.el7
0:1.3.0-2.el7
redhat/tfm-rubygem-fog-core<0:1.45.0-2.el7
0:1.45.0-2.el7
redhat/tfm-rubygem-fog-digitalocean<0:0.3.0-2.el7
0:0.3.0-2.el7
redhat/tfm-rubygem-fog-google<0:0.1.0-4.el7
0:0.1.0-4.el7
redhat/tfm-rubygem-fog-json<0:1.0.2-9.el7
0:1.0.2-9.el7
redhat/tfm-rubygem-fog-libvirt<0:0.4.1-2.el7
0:0.4.1-2.el7
redhat/tfm-rubygem-fog-openstack<0:0.1.25-2.el7
0:0.1.25-2.el7
redhat/tfm-rubygem-fog-ovirt<0:1.1.2-1.el7
0:1.1.2-1.el7
redhat/tfm-rubygem-fog-rackspace<0:0.1.4-2.el7
0:0.1.4-2.el7
redhat/tfm-rubygem-fog-vsphere<0:2.3.0-1.el7
0:2.3.0-1.el7
redhat/tfm-rubygem-fog-xenserver<0:0.2.3-3.el7
0:0.2.3-3.el7
redhat/tfm-rubygem-fog-xml<0:0.1.2-6.el7
0:0.1.2-6.el7
redhat/tfm-rubygem-foreman-tasks<0:0.13.4.2-1.el7
0:0.13.4.2-1.el7
redhat/tfm-rubygem-foreman-tasks-core<0:0.2.5-1.el7
0:0.2.5-1.el7
redhat/tfm-rubygem-formatador<0:0.2.1-10.el7
0:0.2.1-10.el7
redhat/tfm-rubygem-git<0:1.2.5-8.el7
0:1.2.5-8.el7
redhat/tfm-rubygem-google-api-client<0:0.8.2-10.el7
0:0.8.2-10.el7
redhat/tfm-rubygem-gssapi<0:1.2.0-4.el7
0:1.2.0-4.el7
redhat/tfm-rubygem-hashie<0:2.0.5-5.el7
0:2.0.5-5.el7
redhat/tfm-rubygem-highline<0:1.7.8-3.el7
0:1.7.8-3.el7
redhat/tfm-rubygem-http-cookie<0:1.0.2-4.el7
0:1.0.2-4.el7
redhat/tfm-rubygem-ipaddress<0:0.8.0-10.el7
0:0.8.0-10.el7
redhat/tfm-rubygem-jgrep<0:1.3.3-11.el7
0:1.3.3-11.el7
redhat/tfm-rubygem-journald-logger<0:2.0.3-1.el7
0:2.0.3-1.el7
redhat/tfm-rubygem-journald-native<0:1.0.10-1.el7
0:1.0.10-1.el7
redhat/tfm-rubygem-jwt<0:1.2.0-5.el7
0:1.2.0-5.el7
redhat/tfm-rubygem-katello<0:3.7.0.41-1.el7
0:3.7.0.41-1.el7
redhat/tfm-rubygem-launchy<0:2.4.3-5.el7
0:2.4.3-5.el7
redhat/tfm-rubygem-little-plugger<0:1.1.3-22.el7
0:1.1.3-22.el7
redhat/tfm-rubygem-locale<0:2.0.9-12.el7
0:2.0.9-12.el7
redhat/tfm-rubygem-logging<0:2.2.2-4.el7
0:2.2.2-4.el7
redhat/tfm-rubygem-logging-journald<0:1.0.0-1.el7
0:1.0.0-1.el7
redhat/tfm-rubygem-multipart-post<0:1.2.0-5.el7
0:1.2.0-5.el7
redhat/tfm-rubygem-net-ldap<0:0.15.0-2.el7
0:0.15.0-2.el7
redhat/tfm-rubygem-net-ping<0:2.0.1-2.el7
0:2.0.1-2.el7
redhat/tfm-rubygem-netrc<0:0.11.0-2.el7
0:0.11.0-2.el7
redhat/tfm-rubygem-net-scp<0:1.2.1-2.el7
0:1.2.1-2.el7
redhat/tfm-rubygem-net-ssh<0:4.0.1-4.el7
0:4.0.1-4.el7
redhat/tfm-rubygem-net-ssh-krb<0:0.4.0-2.el7
0:0.4.0-2.el7
redhat/tfm-rubygem-oauth<0:0.5.4-2.el7
0:0.5.4-2.el7
redhat/tfm-rubygem-ovirt-engine-sdk<0:4.2.3-1.el7
0:4.2.3-1.el7
redhat/tfm-rubygem-parse-cron<0:0.1.4-3.el7
0:0.1.4-3.el7
redhat/tfm-rubygem-passenger<0:4.0.18-24.el7
0:4.0.18-24.el7
redhat/tfm-rubygem-pg<0:0.21.0-2.el7
0:0.21.0-2.el7
redhat/tfm-rubygem-polyglot<0:0.3.5-2.el7
0:0.3.5-2.el7
redhat/tfm-rubygem-powerbar<0:1.0.17-2.el7
0:1.0.17-2.el7
redhat/tfm-rubygem-prometheus-client<0:0.7.1-1.el7
0:0.7.1-1.el7
redhat/tfm-rubygem-quantile<0:0.2.0-1.el7
0:0.2.0-1.el7
redhat/tfm-rubygem-rabl<0:0.13.1-1.el7
0:0.13.1-1.el7
redhat/tfm-rubygem-rack-jsonp<0:1.3.1-6.el7
0:1.3.1-6.el7
redhat/tfm-rubygem-rails-i18n<0:5.0.4-1.el7
0:5.0.4-1.el7
redhat/tfm-rubygem-rainbow<0:2.2.1-4.el7
0:2.2.1-4.el7
redhat/tfm-rubygem-rbovirt<0:0.1.7-1.el7
0:0.1.7-1.el7
redhat/tfm-rubygem-rbvmomi<0:1.10.0-2.el7
0:1.10.0-2.el7
redhat/tfm-rubygem-responders<0:2.4.0-1.el7
0:2.4.0-1.el7
redhat/tfm-rubygem-rest-client<0:2.0.1-2.el7
0:2.0.1-2.el7
redhat/tfm-rubygem-retriable<0:1.4.1-5.el7
0:1.4.1-5.el7
redhat/tfm-rubygem-roadie<0:3.2.2-1.el7
0:3.2.2-1.el7
redhat/tfm-rubygem-roadie-rails<0:1.2.1-1.el7
0:1.2.1-1.el7
redhat/tfm-rubygem-robotex<0:1.0.0-20.el7
0:1.0.0-20.el7
redhat/tfm-rubygem-ruby2ruby<0:2.4.0-1.el7
0:2.4.0-1.el7
redhat/tfm-rubygem-ruby-libvirt<0:0.7.0-3.el7
0:0.7.0-3.el7
redhat/tfm-rubygem-runcible<0:2.8.1-1.el7
0:2.8.1-1.el7
redhat/tfm-rubygem-safemode<0:1.3.5-1.el7
0:1.3.5-1.el7
redhat/tfm-rubygem-sequel<0:5.7.1-1.el7
0:5.7.1-1.el7
redhat/tfm-rubygem-signet<0:0.6.0-9.el7
0:0.6.0-9.el7
redhat/tfm-rubygem-sshkey<0:1.9.0-2.el7
0:1.9.0-2.el7
redhat/tfm-rubygem-statsd-instrument<0:2.1.4-1.el7
0:2.1.4-1.el7
redhat/tfm-rubygem-trollop<0:2.1.2-2.el7
0:2.1.2-2.el7
redhat/tfm-rubygem-unf<0:0.1.3-6.el7
0:0.1.3-6.el7
redhat/tfm-rubygem-unicode<0:0.4.4.1-5.el7
0:0.4.4.1-5.el7
redhat/tfm-rubygem-useragent<0:0.16.8-2.el7
0:0.16.8-2.el7
redhat/tfm-rubygem-webpack-rails<0:0.9.8-4.el7
0:0.9.8-4.el7
redhat/tfm-rubygem-wicked<0:1.3.2-1.el7
0:1.3.2-1.el7
redhat/tfm-rubygem-x-editable-rails<0:1.5.5-3.el7
0:1.5.5-3.el7
redhat/v8<1:3.14.5.10-19.el7
1:3.14.5.10-19.el7
redhat/yaml-cpp<0:0.5.1-7.el7
0:0.5.1-7.el7
redhat/pulp<2.16.2
2.16.2
Pulpproject Pulp<2.16.2
Fedoraproject Fedora
redhat Satellite=6.4

Event History

Mar 23, 2018
CVE Published
12:00 AM
Jun 18, 2018
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2018-1090?

The severity of CVE-2018-1090 is considered high due to potential exposure of sensitive information through an exposed API.

2

How do I fix CVE-2018-1090?

To fix CVE-2018-1090, upgrade to the patched versions of affected packages such as pulp 2.16.2.

3

Which software versions are affected by CVE-2018-1090?

Affected software versions for CVE-2018-1090 include pulp versions earlier than 2.16.2.

4

What types of attacks can exploit CVE-2018-1090?

CVE-2018-1090 can be exploited through API requests that unintentionally disclose sensitive data entered in configuration overrides.

5

Is there a workaround for CVE-2018-1090?

As a workaround for CVE-2018-1090, limit API access to trusted networks until the vulnerability is patched.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203