Date: Thu, 24 Sep 2015 17:00:49 -0400 From: Randy Barlow <rbarlow@...hat.com> To: OSS Security <oss-security@...ts.openwall.com> Subject: Pulp 2.6.4 released for CVE-2015-5263 Summary ======= The Pulp team has published Pulp 2.6.4 which contains a fix for an important security vulnerability (CVE-2015-5263). Users who use the pulp-consumer CLI to register consumers to the Pulp server should upgrade to pulp-consumer-client>=2.6.4. All versions of pulp-consumer-client from 2.4.0 to 2.6.3 inclusive are vulnerable and should be upgraded. Details ======= A security flaw (CVE-2015-5263) was discovered in Pulp's consumer management system. When the pulp-consumer CLI is used to register to the Pulp server, it downloads a public key from the Pulp server and stores it locally. Later when the Pulp server sends messages to the client via a message broker to instruct it to perform commands, it will use the corresponding private key to sign the messages. The client checks the signatures before executing the instructions to ensure that the messages came from the Pulp server and not from an attacker. Versions of pulp-consumer-client between 2.4.0 and 2.6.3 do not check the server's TLS certificate signatures when retrieving the server's public key upon registration: https://github.com/pulp/pulp/blob/aa432bf58497b5e3682333b1d5f5ae4f45788a61/client_consumer/pulp/client/consumer/cli.py#L103 This allows a man in the middle to inject their own message signing key and to then perform administrative actions on the machine, if they are able to send messages through the message broker. Austin Macdonald fixed this issue in this commit by using our pulp.bindings library as the rest of our CLI does: https://github.com/pulp/pulp/commit/b542d7465f7e6e02e1ea1aec059ac607a65cefe7#diff-17110211f89c042a9267e2167dedd754 Users who do not use pulp-consumer are not affected by this issue. Thanks to Austin Macdonald for writing the fix, to Dennis Kliban for making our beta and release builds, and to Preethi Thomas for testing our releases!  http://www.pulpproject.org/ Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ