Description
client/consumer/cli.py in Pulp before 2.8.3 writes consumer private keys to etc/pki/pulp/consumer/consumer-cert.pem as world-readable, which allows remote authenticated users to obtain the consumer private keys and escalate privileges by reading /etc/pki/pulp/consumer/consumer-cert, and authenticating as a consumer user.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite Capsule 6 | foreman +1 | 1.11.0.49-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite Capsule 6 | foreman-installer | 1:1.11.0.9-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite Capsule 6 | foreman-proxy | 1.11.0.4-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite Capsule 6 | foreman-selinux | 1.11.0.2-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite Capsule 6 | gofer +3 | 2.7.6-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite Capsule 6 | katello +2 | 3.0.0-10.el6sat | RHBA-2016:1501 |
| Red Hat Satellite Capsule 6 | katello-agent | 2.5.0-5.el6sat | RHBA-2016:1501 |
| Red Hat Satellite Capsule 6 | katello-certs-tools | 2.4.0-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite Capsule 6 | katello-client-bootstrap | 1.1.0-2.el6sat | RHBA-2016:1501 |
| Red Hat Satellite Capsule 6 | katello-installer-base +1 | 3.0.0.56-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite Capsule 6 | katello-selinux | 3.0.1.2-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite Capsule 6 | libtasn1 | 3.8-3.el7 | RHBA-2016:1501 |
| Red Hat Satellite Capsule 6 | ostree | 2016.5-3.atomic.el7 | RHBA-2016:1501 |
| Red Hat Satellite Capsule 6 | pulp +17 | 2.8.3.3-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite Capsule 6 | pulp-docker +3 | 2.0.1.1-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite Capsule 6 | pulp-katello | 1.0.1-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite Capsule 6 | pulp-ostree +3 | 1.1.1-2.el7sat | RHBA-2016:1501 |
| Red Hat Satellite Capsule 6 | pulp-rpm +4 | 2.8.3.5-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite Capsule 6 | puppet +1 | 3.8.6-2.el6sat | RHBA-2016:1501 |
| Red Hat Satellite Capsule 6 | puppet-foreman_scap_client | 0.3.3-10.el6 | RHBA-2016:1501 |
| Red Hat Satellite Capsule 6 | puppetlabs-stdlib | 4.2.1-1.20140510git08b00d9.el6_6sat | RHBA-2016:1501 |
| Red Hat Satellite Capsule 6 | python-celery | 3.1.11-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite Capsule 6 | python-nectar | 1.5.1-3.el7sat | RHBA-2016:1501 |
| Red Hat Satellite Capsule 6 | python-qpid | 0.30-9.el6sat | RHBA-2016:1501 |
| Red Hat Satellite Capsule 6 | qpid-cpp +3 | 0.30-11.el6 | RHBA-2016:1501 |
| Red Hat Satellite Capsule 6 | qpid-dispatch +3 | 0.4-13.el6sat | RHBA-2016:1501 |
| Red Hat Satellite Capsule 6 | qpid-proton +2 | 0.9-16.el6 | RHBA-2016:1501 |
| Red Hat Satellite Capsule 6 | qpid-qmf +1 | 0.30-5.el6 | RHBA-2016:1501 |
| Red Hat Satellite Capsule 6 | qpid-tools | 0.30-4.el6 | RHBA-2016:1501 |
| Red Hat Satellite Capsule 6 | rubygem-apipie-bindings | 0.0.14-2.el6sat | RHBA-2016:1501 |
| Red Hat Satellite Capsule 6 | rubygem-kafo | 0.7.6-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite Capsule 6 | rubygem-kafo_parsers | 0.0.6-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite Capsule 6 | rubygem-kafo_wizards | 0.0.1-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite Capsule 6 | rubygem-rubyipmi | 0.10.0-1.el6_6sat | RHBA-2016:1501 |
| Red Hat Satellite Capsule 6 | rubygem-sinatra | 1:1.3.6-27.el6sat | RHBA-2016:1501 |
| Red Hat Satellite Capsule 6 | rubygem-smart_proxy_discovery | 1.0.3-3.el6sat | RHBA-2016:1501 |
| Red Hat Satellite Capsule 6 | rubygem-smart_proxy_discovery_image | 1.0.5-4.el6sat | RHBA-2016:1501 |
| Red Hat Satellite Capsule 6 | rubygem-smart_proxy_dynflow +1 | 0.1.3-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite Capsule 6 | rubygem-smart_proxy_openscap | 0.5.3.6-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite Capsule 6 | rubygem-smart_proxy_pulp | 1.2.2-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite Capsule 6 | rubygem-smart_proxy_remote_execution_ssh | 0.1.2-2.el6sat | RHBA-2016:1501 |
| Red Hat Satellite Capsule 6 | rubygem-tilt | 1.3.3-18.el6sat | RHBA-2016:1501 |
| Red Hat Satellite Capsule 6 | satellite +2 | 6.2.0-21.1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite Capsule 6 | satellite-installer | 6.2.0.11-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite Capsule 6 | tfm-rubygem-dynflow | 0.8.11-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite Capsule 6 | tfm-rubygem-smart_proxy_remote_execution_ssh_core | 0.1.2-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | candlepin +1 | 0.9.54.7-1.el6 | RHBA-2016:1501 |
| Red Hat Satellite 6 | foreman +10 | 1.11.0.49-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | foreman-installer | 1:1.11.0.9-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | foreman-proxy | 1.11.0.4-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | foreman-selinux | 1.11.0.2-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | gofer +3 | 2.7.6-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | katello +3 | 3.0.0-10.el6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | katello-agent | 2.5.0-5.el6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | katello-certs-tools | 2.4.0-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | katello-client-bootstrap | 1.1.0-2.el6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | katello-installer-base +1 | 3.0.0.56-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | katello-selinux | 3.0.1.2-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | libtasn1 | 3.8-3.el7 | RHBA-2016:1501 |
| Red Hat Satellite 6 | ostree | 2016.5-3.atomic.el7 | RHBA-2016:1501 |
| Red Hat Satellite 6 | pulp +15 | 2.8.3.3-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | pulp-docker +3 | 2.0.1.1-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | pulp-katello | 1.0.1-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | pulp-ostree +3 | 1.1.1-2.el7sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | pulp-rpm +4 | 2.8.3.5-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | puppet +1 | 3.8.6-2.el6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | puppet-foreman_scap_client | 0.3.3-10.el6 | RHBA-2016:1501 |
| Red Hat Satellite 6 | puppetlabs-stdlib | 4.2.1-1.20140510git08b00d9.el6_6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | python-celery | 3.1.11-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | python-nectar | 1.5.1-3.el7sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | python-qpid | 0.30-9.el6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | qpid-cpp +4 | 0.30-11.el6 | RHBA-2016:1501 |
| Red Hat Satellite 6 | qpid-dispatch +3 | 0.4-13.el6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | qpid-proton +2 | 0.9-16.el6 | RHBA-2016:1501 |
| Red Hat Satellite 6 | qpid-qmf +1 | 0.30-5.el6 | RHBA-2016:1501 |
| Red Hat Satellite 6 | qpid-tools | 0.30-4.el6 | RHBA-2016:1501 |
| Red Hat Satellite 6 | rubygem-apipie-bindings | 0.0.14-2.el6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | rubygem-foreman_scap_client +1 | 0.1.2-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | rubygem-kafo | 0.7.6-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | rubygem-kafo_parsers +1 | 0.0.6-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | rubygem-kafo_wizards | 0.0.1-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | rubygem-rubyipmi | 0.10.0-1.el6_6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | rubygem-sinatra | 1:1.3.6-27.el6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | rubygem-smart_proxy_discovery | 1.0.3-3.el6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | rubygem-smart_proxy_discovery_image | 1.0.5-4.el6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | rubygem-smart_proxy_dynflow +1 | 0.1.3-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | rubygem-smart_proxy_openscap | 0.5.3.6-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | rubygem-smart_proxy_pulp | 1.2.2-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | rubygem-smart_proxy_remote_execution_ssh | 0.1.2-2.el6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | rubygem-tilt | 1.3.3-18.el6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | satellite +3 | 6.2.0-21.1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | satellite-installer | 6.2.0.11-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | tfm-rubygem-bastion | 3.2.0.9-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | tfm-rubygem-dynflow | 0.8.11-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | tfm-rubygem-foreman-redhat_access | 1.0.10-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | tfm-rubygem-foreman-tasks | 0.7.14.6-3.el6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | tfm-rubygem-foreman_bootdisk | 6.1.0.3-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | tfm-rubygem-foreman_discovery | 5.0.0.8-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | tfm-rubygem-foreman_docker | 2.0.1.11-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | tfm-rubygem-foreman_hooks | 0.3.11-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | tfm-rubygem-foreman_openscap | 0.5.3.17-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | tfm-rubygem-foreman_remote_execution | 0.3.0.11-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | tfm-rubygem-foreman_theme_satellite | 0.1.25-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | tfm-rubygem-hammer_cli | 0.5.1.11-4.el6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | tfm-rubygem-hammer_cli_csv | 2.0.0.1-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | tfm-rubygem-hammer_cli_foreman | 0.5.1.9-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | tfm-rubygem-hammer_cli_foreman_bootdisk | 0.1.3.3-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | tfm-rubygem-hammer_cli_foreman_discovery | 0.0.2.3-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | tfm-rubygem-hammer_cli_foreman_remote_execution | 0.0.5.3-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | tfm-rubygem-hammer_cli_foreman_tasks | 0.0.10.3-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | tfm-rubygem-hammer_cli_import | 0.11.2-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | tfm-rubygem-hammer_cli_katello | 0.0.22.23-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | tfm-rubygem-katello | 3.0.0.68-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | tfm-rubygem-ldap_fluff | 0.4.3-1.el6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | tfm-rubygem-qpid_messaging | 0.30.0-7.el6sat | RHBA-2016:1501 |
| Red Hat Satellite 6 | tfm-rubygem-redhat_access_lib | 1.0.2-1.el6sat | RHBA-2016:1501 |
Advisories 1
- RHBA-2016:1501 Red Hat Bug Fix Advisory: Red Hat Satellite 6.2 Capsule and Server Red Hat Security Advisories (RHSA) · Jun 29, 2026