[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fJsGHzAW31J5b2qyQ4IH0WkY3QDFbPRt_yxtzZthKt_0":3},{"success":4,"data":5},true,{"vendor":6,"topVulnerabilitiesByEpss":32,"kevVulnerabilities":92,"topProductsByCves":93,"seoMetadata":97,"meta":106},{"vendorId":7,"vendorName":8,"productCount":9,"cveCount":10,"kevCount":11,"versionCount":12,"lastCveUpdate":13,"firstLetter":14,"products":15,"description":31},25883,"pulpproject",3,15,0,108,"2024-08-07","p",[16,21,27],{"id":17,"product_name":18,"version_count":19,"cve_count":20,"kev_count":11,"last_cve_update":13},131180,"pulp",57,13,{"id":22,"product_name":23,"version_count":24,"cve_count":25,"kev_count":11,"last_cve_update":26},131181,"pulp_ansible",51,1,"2022-10-25",{"id":28,"product_name":29,"version_count":11,"cve_count":25,"kev_count":11,"last_cve_update":30},131182,"qpid","2017-10-18","Pulpproject is a technology vendor with 3 tracked products and 15 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this vendor.",[33,41,47,52,57,64,70,75,81,87],{"cveId":34,"description":35,"publishedDate":30,"cvssScore":36,"cvssVersion":37,"severity":38,"isKev":39,"epssScore":40},"CVE-2015-5164","The Qpid server on Red Hat Satellite 6 does not properly restrict message types, which allows remote authenticated users with administrative access on a managed content host to execute arbitrary code via a crafted message, related to a pickle processing problem in pulp.",7.2,"v3.0","High",false,0.03956,{"cveId":42,"description":43,"publishedDate":44,"cvssScore":45,"cvssVersion":37,"severity":38,"isKev":39,"epssScore":46},"CVE-2016-3112","client\u002Fconsumer\u002Fcli.py in Pulp before 2.8.3 writes consumer private keys to etc\u002Fpki\u002Fpulp\u002Fconsumer\u002Fconsumer-cert.pem as world-readable, which allows remote authenticated users to obtain the consumer private keys and escalate privileges by reading \u002Fetc\u002Fpki\u002Fpulp\u002Fconsumer\u002Fconsumer-cert, and authenticating as a consumer user.","2017-06-08",7.5,0.02193,{"cveId":48,"description":49,"publishedDate":50,"cvssScore":45,"cvssVersion":37,"severity":38,"isKev":39,"epssScore":51},"CVE-2016-3704","Pulp before 2.8.5 uses bash's $RANDOM in an unsafe way to generate passwords.","2017-06-13",0.0198,{"cveId":53,"description":54,"publishedDate":55,"cvssScore":45,"cvssVersion":37,"severity":38,"isKev":39,"epssScore":56},"CVE-2018-1090","In Pulp before version 2.16.2, secrets are passed into override_config when triggering a task and then become readable to all users with read access on the distributor\u002Fimporter. An attacker with API access can then view these secrets.","2018-06-18",0.01338,{"cveId":58,"description":59,"publishedDate":60,"cvssScore":61,"cvssVersion":37,"severity":62,"isKev":39,"epssScore":63},"CVE-2018-10917","pulp 2.16.x and possibly older is vulnerable to an improper path parsing. A malicious user or a malicious iso feed repository can write to locations accessible to the 'apache' user. This may lead to overwrite of published content on other iso repositories.","2018-08-15",6.5,"Medium",0.01067,{"cveId":65,"description":66,"publishedDate":67,"cvssScore":68,"cvssVersion":37,"severity":62,"isKev":39,"epssScore":69},"CVE-2016-3106","Pulp before 2.8.3 creates a temporary directory during CA key generation in an insecure manner.","2017-04-13",5.3,0.00938,{"cveId":71,"description":72,"publishedDate":73,"cvssScore":45,"cvssVersion":37,"severity":38,"isKev":39,"epssScore":74},"CVE-2013-7450","Pulp before 2.3.0 uses the same the same certificate authority key and certificate for all installations.","2017-04-03",0.00867,{"cveId":76,"description":77,"publishedDate":78,"cvssScore":79,"cvssVersion":37,"severity":38,"isKev":39,"epssScore":80},"CVE-2015-5263","pulp-consumer-client 2.4.0 through 2.6.3 does not check the server's TLS certificate signatures when retrieving the server's public key upon registration.","2017-09-25",8.1,0.00866,{"cveId":82,"description":83,"publishedDate":13,"cvssScore":84,"cvssVersion":85,"severity":38,"isKev":39,"epssScore":86},"CVE-2024-7143","A flaw was found in the Pulp package. When a role-based access control (RBAC) object in Pulp is set to assign permissions on its creation, it uses the `AutoAddObjPermsMixin` (typically the add_roles_for_object_creator method). This method finds the object creator by checking the current authenticated user. For objects that are created within a task, this current user is set by the first user with any permissions on the task object. This means the oldest user with model\u002Fdomain-level task permissions will always be set as the current user of a task, even if they didn't dispatch the task. Therefore, all objects created in tasks will have their permissions assigned to this oldest user, and the creating user will receive nothing.",8.3,"v3.1",0.0061,{"cveId":88,"description":89,"publishedDate":44,"cvssScore":90,"cvssVersion":37,"severity":62,"isKev":39,"epssScore":91},"CVE-2016-3111","pulp.spec in the installation process for Pulp 2.8.3 generates the RSA key pairs used to validate messages between the pulp server and pulp consumers in a directory that is world-readable before later modifying the permissions, which might allow local users to read the generated RSA keys via reading the key files while the installation process is running.",5.5,0.0039,[],[94,95,96],{"id":17,"product_name":18,"version_count":19,"cve_count":20,"kev_count":11,"last_cve_update":13},{"id":22,"product_name":23,"version_count":24,"cve_count":25,"kev_count":11,"last_cve_update":26},{"id":28,"product_name":29,"version_count":11,"cve_count":25,"kev_count":11,"last_cve_update":30},{"title":98,"metaDescription":99,"keywords":100,"structuredData":101},"Pulpproject - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Pulpproject covering 3 products with 15 tracked vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Pulpproject vulnerabilities, Pulpproject security, Pulpproject CVE, Pulpproject threat intelligence, vendor security analysis, cybersecurity threats, vulnerability management, CVE tracking",{"@context":102,"@type":103,"name":104,"description":99,"url":105},"https:\u002F\u002Fschema.org","Organization","Pulpproject","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fpulpproject",{"totalProducts":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":13,"generatedAt":107,"apiVersion":108},"2026-10-17T19:42:59.973Z","3.0"]