https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 00:31:13 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0249 certfr-2026-avi-0249 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0249 https://cve.radiocsirt.org/vuln/euvd-2026-323971 EUVD-2026-323971 https://cve.radiocsirt.org/vuln/euvd-2026-323971 https://cve.radiocsirt.org/vuln/fkie_cve-2024-7143 <p>A flaw was found in the Pulp package. When a role-based access control (RBAC) object in Pulp is set to assign permissions on its creation, it uses the `AutoAddObjPermsMixin` (typically the add_roles_for_object_creator method). This method finds the object creator by checking the current authenticated user. For objects that are created within a task, this current user is set by the first user with any permissions on the task object. This means the oldest user with model/domain-level task permissions will always be set as the current user of a task, even if they didn&#39;t dispatch the task. Therefore, all objects created in tasks will have their permissions assigned to this oldest user, and the creating user will receive nothing.</p> <p>A flaw was found in the Pulp package. When a role-based access control (RBAC) object in Pulp is set to assign permissions on its creation, it uses the `AutoAddObjPermsMixin` (typically the add_roles_for_object_creator method). This method finds the object creator by checking the current authenticated user. For objects that are created within a task, this current user is set by the first user with any permissions on the task object. This means the oldest user with model/domain-level task permissions will always be set as the current user of a task, even if they didn&#39;t dispatch the task. Therefore, all objects created in tasks will have their permissions assigned to this oldest user, and the creating user will receive nothing.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-7143 https://cve.radiocsirt.org/vuln/ghsa-9m5j-4xx9-44j9 <p><strong>Affected:</strong> PyPI: pulpcore</p> <p>A flaw was found in the Pulp package. When a role-based access control (RBAC) object in Pulp is set to assign permissions on its creation, it uses the `AutoAddObjPermsMixin` (typically the add_roles_for_object_creator method). This method finds the object creator by checking the current authenticated user. For objects that are created within a task, this current user is set by the first user with any permissions on the task object. This means the oldest user with model/domain-level task permissions will always be set as the current user of a task, even if they didn&#39;t dispatch the task. Therefore, all objects created in tasks will have their permissions assigned to this oldest user, and the creating user will receive nothing.</p> <p><strong>Affected:</strong> PyPI: pulpcore</p> <p>A flaw was found in the Pulp package. When a role-based access control (RBAC) object in Pulp is set to assign permissions on its creation, it uses the `AutoAddObjPermsMixin` (typically the add_roles_for_object_creator method). This method finds the object creator by checking the current authenticated user. For objects that are created within a task, this current user is set by the first user with any permissions on the task object. This means the oldest user with model/domain-level task permissions will always be set as the current user of a task, even if they didn&#39;t dispatch the task. Therefore, all objects created in tasks will have their permissions assigned to this oldest user, and the creating user will receive nothing.</p> https://cve.radiocsirt.org/vuln/ghsa-9m5j-4xx9-44j9 https://cve.radiocsirt.org/vuln/pysec-2026-1808 <p><strong>Affected:</strong> PyPI: pulpcore</p> <p>A flaw was found in the Pulp package. When a role-based access control (RBAC) object in Pulp is set to assign permissions on its creation, it uses the `AutoAddObjPermsMixin` (typically the add_roles_for_object_creator method). This method finds the object creator by checking the current authenticated user. For objects that are created within a task, this current user is set by the first user with any permissions on the task object. This means the oldest user with model/domain-level task permissions will always be set as the current user of a task, even if they didn&#39;t dispatch the task. Therefore, all objects created in tasks will have their permissions assigned to this oldest user, and the creating user will receive nothing.</p> <p><strong>Affected:</strong> PyPI: pulpcore</p> <p>A flaw was found in the Pulp package. When a role-based access control (RBAC) object in Pulp is set to assign permissions on its creation, it uses the `AutoAddObjPermsMixin` (typically the add_roles_for_object_creator method). This method finds the object creator by checking the current authenticated user. For objects that are created within a task, this current user is set by the first user with any permissions on the task object. This means the oldest user with model/domain-level task permissions will always be set as the current user of a task, even if they didn&#39;t dispatch the task. Therefore, all objects created in tasks will have their permissions assigned to this oldest user, and the creating user will receive nothing.</p> https://cve.radiocsirt.org/vuln/pysec-2026-1808 https://cve.radiocsirt.org/vuln/rhsa-2024:6765 <p>pulpcore: RBAC permissions incorrectly assigned in tasks that create objects golang: net: malformed DNS message can cause infinite loop golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses urllib3: proxy-authorization request header is not stripped during cross-origin redirects</p> <p>pulpcore: RBAC permissions incorrectly assigned in tasks that create objects golang: net: malformed DNS message can cause infinite loop golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses urllib3: proxy-authorization request header is not stripped during cross-origin redirects</p> https://cve.radiocsirt.org/vuln/rhsa-2024:6765