CVE-2016-3107: The Node certificate in Pulp before 2.8.3 contains the private key, and is stored in a world-readable file...

Security readout for executives and security teams

Pulp before 2.8.3 could store a node certificate containing its private key in a world-readable location. A local user on that host could read the key and gain access to sensitive data. The issue is important where untrusted or broadly privileged users can log into Pulp systems. Exposure is most likely on Pulp deployments earlier than 2.8.3 where local users can access the host filesystem. Internet-only attackers are not supported by the provided evidence; the described attacker is local. Treat as a targeted operational exposure rather than an internet-scale emergency. Prioritize environments where Pulp servers are shared, have many local users, or manage sensitive content distribution. Mitigation focus: Upgrade Pulp to 2.8.3 or later where applicable.; Apply Red Hat advisory RHBA-2016:1501 packages if using affected Red Hat builds.; Restrict local shell access on Pulp hosts to trusted administrators..

Prepared

Jun 13, 2026, 04:43 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.