Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS05bTVqLTR4eDktNDRqOc4AA-dn

Pulp incorrectly assigns RBAC permissions in tasks that create objects

A flaw was found in the Pulp package. When a role-based access control (RBAC) object in Pulp is set to assign permissions on its creation, it uses the AutoAddObjPermsMixin (typically the add_roles_for_object_creator method). This method finds the object creator by checking the current authenticated user. For objects that are created within a task, this current user is set by the first user with any permissions on the task object. This means the oldest user with model/domain-level task permissions will always be set as the current user of a task, even if they didn't dispatch the task. Therefore, all objects created in tasks will have their permissions assigned to this oldest user, and the creating user will receive nothing.

Permalink: https://github.com/advisories/GHSA-9m5j-4xx9-44j9
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS05bTVqLTR4eDktNDRqOc4AA-dn
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 4 months ago
Updated: 5 days ago


CVSS Score: 6.7
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

Identifiers: GHSA-9m5j-4xx9-44j9, CVE-2024-7143
References: Repository: https://github.com/pulp/pulpcore
Blast Radius: 12.1

Affected Packages

pypi:pulpcore
Dependent packages: 12
Dependent repositories: 65
Downloads: 49,413 last month
Affected Version Ranges: <= 3.56.0
No known fixed version
All affected versions: 3.0.0, 3.0.1, 3.1.0, 3.1.1, 3.2.0, 3.2.1, 3.3.0, 3.3.1, 3.4.0, 3.4.1, 3.5.0, 3.6.0, 3.6.1, 3.6.2, 3.6.3, 3.6.4, 3.7.0, 3.7.1, 3.7.2, 3.7.3, 3.7.4, 3.7.5, 3.7.6, 3.7.7, 3.7.8, 3.7.9, 3.8.0, 3.8.1, 3.9.0, 3.9.1, 3.10.0, 3.11.0, 3.11.1, 3.11.2, 3.12.0, 3.12.1, 3.12.2, 3.13.0, 3.14.0, 3.14.1, 3.14.2, 3.14.3, 3.14.4, 3.14.5, 3.14.6, 3.14.7, 3.14.8, 3.14.9, 3.14.10, 3.14.11, 3.14.12, 3.14.13, 3.14.14, 3.14.15, 3.14.16, 3.14.17, 3.14.18, 3.14.19, 3.15.0, 3.15.1, 3.15.2, 3.15.3, 3.15.4, 3.15.5, 3.15.6, 3.15.7, 3.15.8, 3.15.9, 3.16.0, 3.16.1, 3.16.2, 3.16.3, 3.16.4, 3.16.5, 3.16.6, 3.16.7, 3.16.8, 3.16.9, 3.16.10, 3.16.11, 3.16.12, 3.16.13, 3.16.14, 3.16.15, 3.16.16, 3.16.17, 3.16.18, 3.16.19, 3.16.20, 3.16.21, 3.16.22, 3.16.23, 3.16.24, 3.17.0, 3.17.1, 3.17.2, 3.17.3, 3.17.4, 3.17.5, 3.17.6, 3.17.7, 3.17.8, 3.18.0, 3.18.1, 3.18.2, 3.18.3, 3.18.4, 3.18.5, 3.18.6, 3.18.7, 3.18.8, 3.18.9, 3.18.10, 3.18.11, 3.18.12, 3.18.13, 3.18.14, 3.18.15, 3.18.16, 3.18.17, 3.18.18, 3.18.19, 3.18.20, 3.18.21, 3.18.22, 3.18.23, 3.18.24, 3.18.25, 3.18.26, 3.18.27, 3.18.28, 3.18.29, 3.18.30, 3.18.31, 3.18.32, 3.18.33, 3.18.34, 3.18.35, 3.19.0, 3.19.1, 3.20.0, 3.21.0, 3.21.1, 3.21.2, 3.21.3, 3.21.4, 3.21.5, 3.21.6, 3.21.7, 3.21.8, 3.21.9, 3.21.10, 3.21.11, 3.21.12, 3.21.13, 3.21.14, 3.21.15, 3.21.16, 3.21.17, 3.21.18, 3.21.19, 3.21.20, 3.21.21, 3.21.22, 3.21.23, 3.21.24, 3.21.25, 3.21.26, 3.21.29, 3.21.30, 3.21.31, 3.21.32, 3.21.33, 3.21.34, 3.21.35, 3.21.36, 3.22.0, 3.22.1, 3.22.2, 3.22.3, 3.22.4, 3.22.5, 3.22.6, 3.22.7, 3.22.8, 3.22.9, 3.22.10, 3.22.11, 3.22.12, 3.22.13, 3.22.14, 3.22.15, 3.22.16, 3.22.17, 3.22.18, 3.22.19, 3.22.20, 3.22.21, 3.22.22, 3.22.24, 3.22.25, 3.22.26, 3.22.27, 3.22.28, 3.22.29, 3.22.30, 3.22.31, 3.22.32, 3.22.33, 3.23.0, 3.23.1, 3.23.2, 3.23.3, 3.23.4, 3.23.5, 3.23.6, 3.23.7, 3.23.8, 3.23.9, 3.23.10, 3.23.11, 3.23.12, 3.23.13, 3.23.14, 3.23.15, 3.23.16, 3.23.17, 3.23.18, 3.23.19, 3.23.20, 3.23.21, 3.23.22, 3.23.23, 3.23.24, 3.24.0, 3.24.1, 3.25.0, 3.25.1, 3.26.0, 3.26.1, 3.26.2, 3.27.0, 3.27.1, 3.27.2, 3.28.0, 3.28.1, 3.28.2, 3.28.3, 3.28.4, 3.28.5, 3.28.6, 3.28.7, 3.28.8, 3.28.9, 3.28.10, 3.28.11, 3.28.12, 3.28.13, 3.28.14, 3.28.15, 3.28.16, 3.28.17, 3.28.18, 3.28.19, 3.28.20, 3.28.21, 3.28.22, 3.28.23, 3.28.24, 3.28.25, 3.28.26, 3.28.27, 3.28.28, 3.28.29, 3.28.30, 3.28.31, 3.28.32, 3.28.33, 3.28.34, 3.29.0, 3.29.1, 3.29.2, 3.29.3, 3.29.4, 3.29.5, 3.29.6, 3.29.7, 3.29.8, 3.30.0, 3.31.0, 3.32.0, 3.32.1, 3.33.0, 3.34.0, 3.35.0, 3.36.0, 3.37.0, 3.38.0, 3.38.1, 3.39.0, 3.39.1, 3.39.2, 3.39.3, 3.39.4, 3.39.5, 3.39.6, 3.39.7, 3.39.8, 3.39.9, 3.39.10, 3.39.11, 3.39.12, 3.39.13, 3.39.14, 3.39.15, 3.39.16, 3.39.17, 3.39.18, 3.39.19, 3.39.20, 3.39.21, 3.39.22, 3.39.23, 3.40.0, 3.40.1, 3.40.2, 3.40.3, 3.40.4, 3.41.0, 3.41.1, 3.42.0, 3.43.0, 3.43.1, 3.43.2, 3.43.3, 3.44.0, 3.44.1, 3.45.0, 3.45.1, 3.45.2, 3.45.3, 3.45.4, 3.46.0, 3.47.0, 3.48.0, 3.49.0, 3.49.1, 3.49.2, 3.49.3, 3.49.4, 3.49.5, 3.49.6, 3.49.7, 3.49.8, 3.49.9, 3.49.10, 3.49.11, 3.49.12, 3.49.13, 3.49.14, 3.49.15, 3.49.16, 3.49.17, 3.49.18, 3.49.19, 3.49.20, 3.49.21, 3.49.22, 3.49.23, 3.49.24, 3.50.0, 3.50.1, 3.50.2, 3.50.3, 3.51.0, 3.51.1, 3.51.2, 3.51.3, 3.52.0, 3.53.0, 3.53.1, 3.54.0, 3.54.1, 3.55.0, 3.55.1, 3.55.2, 3.55.3, 3.56.0