GitHub Advisoryadvisory · PyPI

GHSA-qv37-mfjf-42h8 Plaintext storage of tokens in pulp_ansible

MEDIUM Published 2022-10-25 Modified 2022-10-31 Official page ↗
Aliases
CVE-2022-3644
Ecosystem
PyPI
Packages
pulp-ansible
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-256, CWE-522
Reviewed
2022-10-25

Affected packages

• PyPI pulp-ansible: < 0.15.0 → fixed in 0.15.0

Description

The collection remote for pulp_ansible stores tokens in plaintext instead of using pulp's encrypted field and exposes them in read/write mode via the API () instead of marking it as write only.

Related

Alias · CVE (1)

  • CVE-2022-3644 The collection remote for pulp_ansible stores tokens in plaintext instead of using pulp's encrypted field and exposes them in read/write… vulnerability

Weakness · CWE (2)

  • CWE-256 Plaintext Storage of a Password weakness
  • CWE-522 Insufficiently Protected Credentials weakness

References