In Pulp before version 2.16.2, secrets are passed into override_config when triggering a task and then become readable to all users with read access on the distributor/importer. An attacker with API access can then view these secrets.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2018-06-18T14:00:00

Updated: 2024-08-05T03:51:49.104Z

Reserved: 2017-12-04T00:00:00

Link: CVE-2018-1090

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2018-06-18T14:29:00.277

Modified: 2019-10-09T23:38:05.677

Link: CVE-2018-1090

cve-icon Redhat

Severity : Moderate

Publid Date: 2018-03-23T00:00:00Z

Links: CVE-2018-1090 - Bugzilla