[Pulp-list] Important: Pulp 2.6.4 released for CVE-2015-5263

Randy Barlow rbarlow at redhat.com
Thu Sep 24 20:57:22 UTC 2015

The Pulp team has published Pulp 2.6.4 which contains a fix for
an important security vulnerability (CVE-2015-5263). Users who use the
pulp-consumer CLI to register consumers to the Pulp server should
upgrade to pulp-consumer-client>=2.6.4. All versions of
pulp-consumer-client from 2.4.0 to 2.6.3 inclusive are vulnerable and
should be upgraded.


A security flaw (CVE-2015-5263) was discovered in Pulp's consumer
management system. When the pulp-consumer CLI is used to register to the
Pulp server, it downloads a public key from the Pulp server and stores
it locally. Later when the Pulp server sends messages to the client via
a message broker to instruct it to perform commands, it will use the
corresponding private key to sign the messages. The client checks the
signatures before executing the instructions to ensure that the messages
came from the Pulp server and not from an attacker.

Versions of pulp-consumer-client between 2.4.0 and 2.6.3 do not check
the server's TLS certificate signatures when retrieving the server's
public key upon registration:


This allows a man in the middle to inject their own message signing
key and to then perform administrative actions on the machine, if they
are able to send messages through the message broker.

Austin Macdonald fixed this issue in this commit by using our
pulp.bindings library as the rest of our CLI does:


Users who do not use pulp-consumer are not affected by this issue.

Thanks to Austin Macdonald for writing the fix, to Dennis Kliban for making
our beta and release build, and to Preethi Thomas for testing our
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/pulp-list/attachments/20150924/c37c15fb/attachment.sig>

More information about the Pulp-list mailing list