PT-2022-14031 · Red Hat · Convert2Rhel

Todd Cullum · Published 2022-07-14 · Updated 2022-07-20 · CVE-2022-1662

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions convert2rhel (affected versions not specified)

Description The issue concerns an ansible playbook named ansible/run-convert2rhel.yml in convert2rhel, which passes the Red Hat Subscription Manager user password via the CLI to convert2rhel. This could allow unauthorized local users to view the password via the process list while convert2rhel is running. It is noted that this ansible playbook is only an example in the upstream repository and is not shipped in officially supported versions of convert2rhel.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2022-1662

Affected Products

Convert2Rhel

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2022-1662 · Security Note
• https://osv.dev/vulnerability/CVE-2022-1662 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2083851 · Patch
• https://t.me/cibsecurity/46242 · Telegram Post