Security readout for executives and security teams
Plain-English summary
Pulp can assign permissions for objects created by background tasks to the wrong user. Instead of granting access to the person who started the task, it may grant access to the oldest user with task-level permissions. This can expose or alter managed content permissions, but the sources rate it medium and require already high privileges.
Executive priority
Treat this as a moderate-priority access-control issue. It is unlikely to be broadly exploitable without privileged access, but affected automation platforms may misassign permissions in ways that expose sensitive content or disrupt administrative workflows.
Technical view
AutoAddObjPermsMixin identifies an object creator from the current authenticated user. For task-created objects, that user may be derived from the first user with permissions on the task object, not the dispatcher. Task-created objects can therefore receive RBAC permissions for the wrong account, leaving the actual creator without assigned access.
Likely exposure
The bundle identifies Red Hat Ansible Automation Platform 2 pulpcore packages as affected. Red Hat Satellite 6 and Red Hat Update Infrastructure 4 are listed as unaffected. Exposure is most relevant where Pulp task workflows create RBAC-protected objects and multiple privileged users have task permissions.
Exploitation context
No KEV listing or cited source in the bundle indicates active exploitation. The CVSS vector requires high privileges, with network access, low attack complexity, no user interaction, and potential high confidentiality and integrity impact plus low availability impact.
Researcher notes
Focus analysis on task execution identity and RBAC assignment paths around AutoAddObjPermsMixin and add_roles_for_object_creator. Evidence supports permission misassignment during task-created object creation; the bundle does not provide exploit proof, fixed version details, or active exploitation evidence.
Mitigation direction
- Apply updates from RHSA-2024:6765 where applicable.
- Check Red Hat and Pulp guidance for fixed pulpcore versions.
- Review privileged task-permission assignments in affected Pulp deployments.
- Limit broad model or domain-level task permissions to required administrators.
- Audit unexpected RBAC grants on objects created by tasks.
Validation and detection
- Identify whether Ansible Automation Platform 2 uses affected pulpcore packages.
- Review task-created objects for permissions granted to unexpected older privileged users.
- Confirm Satellite 6 and RHUI 4 status against vendor inventory records.
- Check advisory and changelog for the deployed pulpcore fixed version.
- Review logs or audit data for abnormal permission ownership changes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-277: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-7143 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.7 (3.0)
- Known Exploited
- No
- Published
Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L1.25.5redhatVulnerability scoring details
Base CVSS 3.0 score
6.7MediumVector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- Source timelineredhat
Reported to Red Hat.
- Source timelineredhat
Made public.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- RHSA-2024:6765CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2024-7143CVE reference, redhat · vdb-entry, x_refsource_REDHAT
- RHBZ#2300125CVE reference, redhat · issue-tracking, x_refsource_REDHAT
- https://github.com/advisories/GHSA-9m5j-4xx9-44j9CVE reference, redhat
- https://github.com/pulp/pulpcore/blob/93f241f34c503da0fbac94bdba739feda2636e12/pulpcore/tasking/_util.py#L108CVE reference, redhat
- https://github.com/pulp/pulpcore/blob/main/CHANGES.mdCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Insecure Inherited Permissions
Insecure Inherited Permissions represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.