The collection remote for pulp_ansible stores tokens in plaintext instead of using pulp's encrypted field and exposes them in read/write mode via the API () instead of marking it as write only.
References
| Link | Resource |
|---|---|
| https://github.com/pulp/pulp_ansible/blob/main/pulp_ansible/app/models.py#L234 | Exploit Third Party Advisory |
Configurations
History
28 Oct 2022, 19:01
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:redhat:satellite:6.0:*:*:*:*:*:*:* cpe:2.3:a:pulpproject:pulp_ansible:-:*:*:*:*:*:*:* cpe:2.3:a:redhat:ansible_automation_platform:2.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:update_infrastructure:3.0:*:*:*:*:*:*:* |
|
| First Time |
Redhat satellite
Redhat update Infrastructure Redhat Pulpproject pulp Ansible Pulpproject Redhat ansible Automation Platform |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
| CWE | CWE-522 | |
| References | (MISC) https://github.com/pulp/pulp_ansible/blob/main/pulp_ansible/app/models.py#L234 - Exploit, Third Party Advisory |
25 Oct 2022, 18:37
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-10-25 18:15
Updated : 2023-12-10 14:35
NVD link : CVE-2022-3644
Mitre link : CVE-2022-3644
CVE.ORG link : CVE-2022-3644
JSON object : View
Products Affected
pulpproject
- pulp_ansible
redhat
- satellite
- ansible_automation_platform
- update_infrastructure