Threats tagged 'ghsa-mxj6-qp96-8hrw'

An expression language injection vulnerability exists in the HeaderContentGuard.permit function in Pulpcore's publication.py. This flaw allows a low-privileged attacker who can create and attach a header content guard to a distribution to execute a jq filter that can access the environment of the content process. By repeatedly making content requests, the attacker can extract sensitive environment data, including Pulp settings such as the Django secret key and database password. The vulnerability was introduced in Pulpcore 3.39.0 and affects default configurations. Red Hat Satellite and RHUI 5 are not affected. No practical workaround is currently available.