PyPI: pulp-ansible
CVE-2022-3644
Safety vulnerability ID: SFTY-20221025-12256
Safety legacy ID: pyup.io-54557
Pulp-ansible 0.15.0 includes a fix for CVE-2022-3644: The collection remote for pulp_ansible stores tokens in plaintext instead of using pulp's encrypted field and exposes them in read/write mode via the API () instead of marking it as write only. https://github.com/pulp/pulp_ansible/pull/1222
Overview
Plaintext storage of tokens in pulp_ansible
Advisory
Pulp-ansible 0.15.0 includes a fix for CVE-2022-3644: The collection remote for pulp_ansible stores tokens in plaintext instead of using pulp's encrypted field and exposes them in read/write mode via the API () instead of marking it as write only. https://github.com/pulp/pulp_ansible/pull/1222
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20221025-12256/CVE-2022-3644
- https://nvd.nist.gov/vuln/detail/CVE-2022-3644
- https://github.com/pulp/pulp_ansible/blob/main/pulp_ansible/app/models.py#L234
- https://github.com/pulp/pulp_ansible/issues/1221
- https://github.com/pulp/pulp_ansible/commit/d13c427b09482a7f598d8ee597d17a8a34888665
- https://github.com/advisories/GHSA-qv37-mfjf-42h8
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more