The collection remote for pulp_ansible stores tokens in plaintext instead of using pulp's encrypted field and exposes them in read/write mode via the API () instead of marking it as write only.
References
| Link | Resource |
|---|---|
| https://github.com/pulp/pulp_ansible/blob/main/pulp_ansible/app/models.py#L234 | Exploit Third Party Advisory |
Configurations
History
28 Oct 2022, 19:01
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-522 | |
| CPE | cpe:2.3:a:pulpproject:pulp_ansible:-:*:*:*:*:*:*:* cpe:2.3:a:redhat:satellite:6.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:update_infrastructure:3.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:ansible_automation_platform:2.0:*:*:*:*:*:*:* |
|
| References | (MISC) https://github.com/pulp/pulp_ansible/blob/main/pulp_ansible/app/models.py#L234 - Exploit, Third Party Advisory | |
| References | (MISC) https://github.com/pulp/pulp_ansible/blob/main/pulp_ansible/app/models.py#L234 - Exploit, Third Party Advisory | |
| CPE | cpe:2.3:a:pulpproject:pulp_ansible:-:*:*:*:*:*:*:* cpe:2.3:a:redhat:satellite:6.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:update_infrastructure:3.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:ansible_automation_platform:2.0:*:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
25 Oct 2022, 18:37
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-10-25 18:15
Updated : 2024-02-04 22:51
NVD link : CVE-2022-3644
Mitre link : CVE-2022-3644
CVE.ORG link : CVE-2022-3644
JSON object : View
Products Affected
redhat
- satellite
- update_infrastructure
- ansible_automation_platform
pulpproject
- pulp_ansible