CVE-2022-3644

Description

The collection remote for pulp_ansible stores tokens in plaintext instead of using pulp's encrypted field and exposes them in read/write mode via the API () instead of marking it as write only.

CVSS Metrics

• v3.1•MEDIUM•Score: 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS Trends

Current EPSS score: 0.05%• Percentile: 15%

Techniques & Countermeasures

• CWE-256•Plaintext Storage of a Password

  The product stores a password in plaintext within resources such as memory or files.

• CWE-522•Insufficiently Protected Credentials

  The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Affected Systems

• pulpproject•pulp_ansible

  na

• PyPI•pulp-ansible

  < 0.15.0

• redhat•ansible_automation_platform

  2.0

• redhat•satellite

  6.0

• redhat•update_infrastructure

  3.0

References (5)

• https://github.com/pulp/pulp_ansible/blob/main/pulp_ansible/app/models.py#L234
• https://nvd.nist.gov/vuln/detail/CVE-2022-3644
• https://github.com/pulp/pulp_ansible/issues/1221
• https://github.com/pulp/pulp_ansible/commit/d13c427b09482a7f598d8ee597d17a8a34888665
• https://github.com/pulp/pulp_ansible