CVE-2024-7143

Advisory

Pulpcore fixed an issue where RBAC permissions were incorrectly assigned during task-based object creation. In Pulp, the `AutoAddObjPermsMixin` assigns permissions to the oldest user with task permissions instead of the actual task initiator. This resulted in the wrong user receiving permissions, leaving the creating user with none.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

REST API {: 3.22.30-rest-api }

Bugfixes {: 3.22.30-rest-api-bugfix }

- Fixed RBAC permissions being incorrectly assigned in tasks that create objects.
https://access.redhat.com/security/cve/cve-2024-7143
[5683](https://github.com/pulp/pulpcore/issues/5683)

Plugin API {: 3.22.30-plugin-api }

No significant changes.

---

Resources

• https://github.com/pulp/pulpcore/pull/5688/commits/d226a21046e0233b273028569b9d976597557b70
• https://github.com/pulp/pulpcore/pull/5688
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7143