CVE-2015-5263 : pulp-consumer-client 2.4.0 through 2.6.3 does not check the server's TLS certifi

pulp-consumer-client 2.4.0 through 2.6.3 does not check the server's TLS certificate signatures when retrieving the server's public key upon registration.

Published 2017-09-25 21:29:00

Updated 2017-10-05 18:58:38

Source Red Hat, Inc.

View at NVD, CVE.org

Products affected by CVE-2015-5263

Pulpproject » Pulp » Version: 2.4.0
cpe:2.3:a:pulpproject:pulp:2.4.0:*:*:*:*:*:*:*
Matching versions
Pulpproject » Pulp » Version: 2.4.2
cpe:2.3:a:pulpproject:pulp:2.4.2:*:*:*:*:*:*:*
Matching versions
Pulpproject » Pulp » Version: 2.4.4
cpe:2.3:a:pulpproject:pulp:2.4.4:*:*:*:*:*:*:*
Matching versions
Pulpproject » Pulp » Version: 2.4.1
cpe:2.3:a:pulpproject:pulp:2.4.1:*:*:*:*:*:*:*
Matching versions
Pulpproject » Pulp » Version: 2.4.3
cpe:2.3:a:pulpproject:pulp:2.4.3:*:*:*:*:*:*:*
Matching versions
Pulpproject » Pulp » Version: 2.5.1
cpe:2.3:a:pulpproject:pulp:2.5.1:*:*:*:*:*:*:*
Matching versions
Pulpproject » Pulp » Version: 2.5.2
cpe:2.3:a:pulpproject:pulp:2.5.2:*:*:*:*:*:*:*
Matching versions
Pulpproject » Pulp » Version: 2.5.3
cpe:2.3:a:pulpproject:pulp:2.5.3:*:*:*:*:*:*:*
Matching versions
Pulpproject » Pulp » Version: 2.5.0
cpe:2.3:a:pulpproject:pulp:2.5.0:*:*:*:*:*:*:*
Matching versions
Pulpproject » Pulp » Version: 2.6.2
cpe:2.3:a:pulpproject:pulp:2.6.2:*:*:*:*:*:*:*
Matching versions
Pulpproject » Pulp » Version: 2.6.3
cpe:2.3:a:pulpproject:pulp:2.6.3:*:*:*:*:*:*:*
Matching versions
Pulpproject » Pulp » Version: 2.6.0
cpe:2.3:a:pulpproject:pulp:2.6.0:*:*:*:*:*:*:*
Matching versions
Pulpproject » Pulp » Version: 2.6.1
cpe:2.3:a:pulpproject:pulp:2.6.1:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2015-5263

EPSS FAQ

0.30%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 69 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2015-5263

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.8	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:P	8.6	6.4	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
8.1	HIGH	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	2.2	5.9	NIST
Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2015-5263

CWE-295 Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2015-5263

http://cve.killedkenny.io/cve/CVE-2015-5263

** RESERVED ** · CVE-2015-5263
Third Party Advisory
https://github.com/pulp/pulp/blob/aa432bf58497b5e3682333b1d5f5ae4f45788a61/client_consumer/pulp/client/consumer/cli.py#L103

pulp/cli.py at aa432bf58497b5e3682333b1d5f5ae4f45788a61 · pulp/pulp · GitHub
Third Party Advisory
https://github.com/pulp/pulp/commit/b542d7465f7e6e02e1ea1aec059ac607a65cefe7#diff-17110211f89c042a9267e2167dedd754

convert consumer register to bindings · pulp/pulp@b542d74 · GitHub
Patch;Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/09/24/4

oss-security - Pulp 2.6.4 released for CVE-2015-5263
Mailing List;Third Party Advisory

Jump to

Vulnerability Details : CVE-2015-5263

Products affected by CVE-2015-5263

Exploit prediction scoring system (EPSS) score for CVE-2015-5263

CVSS scores for CVE-2015-5263

CWE ids for CVE-2015-5263

References for CVE-2015-5263