6.5
CVSS 3.1
Няма данни
Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)
Няма потвърждение
Атакува се
Няма данни
Време до експлоатация
Атакува се по мрежата, без особени условия, с обикновен потребителски вход и без действие от потребителя.
- Експлоатация: няма данни за експлоатация
- Атаката не може да се автоматизира
Описание
Оригинално описание
A flaw was found in pulp-container when it authenticates to an upstream registry. Basic and bearer credentials from one remote are reused for later downloads in the same worker. A user who can sync a container remote, and can point that remote at a server they control, receives the username, password, or bearer token stored for a different remote, and can reuse that credential at the upstream registry. Content stored in Pulp is not changed, and the service is not stopped.
Засегнати продукти
- Red Hat Red Hat Ansible Automation Platform 2
- Red Hat Red Hat Ansible Automation Platform 2
- Red Hat Red Hat Ansible Automation Platform 2
- Red Hat Red Hat Ansible Automation Platform 2
- Red Hat Red Hat Ansible Automation Platform 2
- Red Hat Red Hat Ansible Automation Platform 2
- Red Hat Red Hat Ansible Automation Platform 2
- Red Hat Red Hat Ansible Automation Platform 2
- Red Hat Red Hat Satellite 6
- Red Hat Red Hat Satellite 6
- Red Hat Red Hat Update Infrastructure 4 for Cloud Providers
- Red Hat Red Hat Update Infrastructure 4 for Cloud Providers
- Red Hat Red Hat Update Infrastructure 5
- Red Hat Red Hat Update Infrastructure 5
- Red Hat Red Hat Update Infrastructure 5
Вид слабост
История
- 7 октомври 2026 Публикувано