Log in Start free

Vulnerability · Published Aug 7, 2024 · Assigned by redhat

CVE-2024-7143Pulpcore: rbac permissions incorrectly assigned in tasks that create objects

Medium 6.7

In plain English

A medium-severity security flaw in pulp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).

Severity (CVSS 3.0)6.7Medium
Exploit odds (30 days)0.6%top 50.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in the Pulp package. When a role-based access control (RBAC) object in Pulp is set to assign permissions on its creation, it uses the `AutoAddObjPermsMixin` (typically the add_roles_for_object_creator method). This method finds the object creator by checking the current authenticated user. For objects that are created within a task, this current user is set by the first user with any permissions on the task object. This means the oldest user with model/domain-level task permissions will always be set as the current user of a task, even if they didn't dispatch the task. Therefore, all objects created in tasks will have their permissions assigned to this oldest user, and the creating user will receive nothing.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIpulpcoreno fix listedGHSA-9m5j-4xx9-44j9
PyPIpulpcoreno fix listedPYSEC-2026-1808

Affected products (as reported)

VendorProductVersions
pulp 0 – through 3.56.0
Red Hat Red Hat Ansible Automation Platform 2 see references
Red Hat Red Hat Ansible Automation Platform 2 see references
Red Hat Red Hat Satellite 6 see references
Red Hat Red Hat Update Infrastructure 4 for Cloud Providers see references

Weakness: CWE-277 · Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

References