CVE-2016-3112: client/consumer/cli.py in Pulp before 2.8.3 writes consumer private keys to etc/pki/pulp/consumer/consumer-...

Security readout for executives and security teams

Pulp versions before 2.8.3 could create a consumer private key file that was readable by other users. An authenticated remote user could obtain that key and authenticate as a consumer user, creating a privilege escalation risk in affected Pulp environments. Exposure appears limited to organizations running Pulp before 2.8.3 with consumer certificate material present at the documented path. The source bundle does not identify broader products, package versions, CVSS, or CPEs. Prioritize assessment where Pulp supports operational content distribution or trusted automation. Business urgency depends on whether vulnerable versions are deployed and whether authenticated users could access the exposed key file. Mitigation focus: Identify any Pulp deployments older than 2.8.3.; Upgrade to Pulp 2.8.3 or a vendor-supported fixed package.; Review Red Hat RHBA-2016:1501 guidance for applicable packaged fixes..

Prepared

Jun 13, 2026, 04:43 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.