GitHub Advisoryadvisory · PyPI

GHSA-w4x6-6w3r-9h2m tripleo-ansible may disclose important configuration details from an OpenStack deployment

MEDIUM Published 2023-03-23 Modified 2023-03-30 Official page ↗
Aliases
CVE-2022-3146
Ecosystem
PyPI
Packages
tripleo-ansible
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22, CWE-276, CWE-732
Reviewed
2023-03-23

Affected packages

• PyPI tripleo-ansible: <= 6.0.0 (no fix yet)

Description

A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw allows a local attacker to use brute force to explore the relevant directory and discover the file. This issue leads to information disclosure of important configuration details from the OpenStack deployment.

Related

Alias · CVE (1)

  • CVE-2022-3146 A flaw was found in tripleo-ansible. vulnerability

Weakness · CWE (3)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
  • CWE-276 Incorrect Default Permissions weakness
  • CWE-732 Incorrect Permission Assignment for Critical Resource weakness

References