Description
Pulp before 2.3.0 uses the same the same certificate authority key and certificate for all installations.
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1328345
- [oss-security] 20160418 Re: CVE request - Pulp < 2.3.0 shipped the same authentication CA key/cert to all users mailing-list
- https://bugzilla.redhat.com/show_bug.cgi?id=1003326
- https://github.com/pulp/pulp/pull/627
- [oss-security] 20160519 Pulp 2.8.3 Released to address multiple CVEs mailing-list
- [oss-security] 20160418 CVE-2013-7450: Pulp < 2.3.0 distributed the same CA key to all users mailing-list