PT-2022-14098 · Anchore · Anchorectl

Published 2022-07-20 · Updated 2022-07-27 · CVE-2022-1766

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Anchore Enterprise anchorectl version 0.1.4

Description The issue arises from improper storage of credentials when generating a Software Bill of Materials. Specifically, anchorectl adds the credentials used to access the Anchore Enterprise API to the Software Bill of Materials (SBOM) it generates.

Recommendations For Anchore Enterprise anchorectl version 0.1.4, upgrade to anchorectl version 0.1.5 to resolve the issue.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2022-1766

Affected Products

Anchorectl

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2022-1766 · Security Note
• https://osv.dev/vulnerability/CVE-2022-1766 · Vendor Advisory
• https://docs.anchore.com/current/docs/releasenotes/401 · Vendor Advisory
• https://t.me/cibsecurity/46696 · Telegram Post