CVE-2022-3644: Medium severity Pulpproject Pulp Ansible vulnerability
The collection remote for pulpansible stores tokens in plaintext instead of using pulp's encrypted field (https://github.com/pulp/pulpansible/blob/main/pulpansible/app/models.py#L234) and exposes them in read/write mode via the API (https://github.com/pulp/pulpansible/blob/main/pulpansible/app/serializers.py#L170) instead of marking it as write only.
Other sources
The collection remote for pulpansible stores tokens in plaintext instead of using pulp's encrypted field and exposes them in read/write mode via the API () instead of marking it as write only.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Change the collection remote model to store tokens using pulp's encrypted field (rather than plaintext) as referenced in pulp_ansible/app/models.py.
pulp_ansible collection remote model (pulp_ansible/app/models.py) token storage = use pulp's encrypted field instead of plaintext - Configuration
Mark the token field as write-only in the API serializer so tokens are accepted on input but not exposed in read responses (modify the serializer in pulp_ansible/app/serializers.py to set the token field write_only).
pulp_ansible API serializer (pulp_ansible/app/serializers.py) token field access = write_only = true
Event History
Frequently Asked Questions
What is CVE-2022-3644?
CVE-2022-3644 is a vulnerability in the collection remote for pulp_ansible that stores tokens in plaintext instead of using pulp's encrypted field and exposes them in read/write mode via the API.
What is the severity of CVE-2022-3644?
CVE-2022-3644 has a severity rating of medium, with a severity value of 5.5.
Which software is affected by CVE-2022-3644?
Pulpproject Pulp Ansible, Redhat Ansible Automation Platform 2.0, Redhat Satellite 6.0, and Redhat Update Infrastructure 3.0 are affected by CVE-2022-3644.
How can I fix CVE-2022-3644?
To fix CVE-2022-3644, it is recommended to update the affected software to a version that addresses the vulnerability.
Where can I find more information about CVE-2022-3644?
You can find more information about CVE-2022-3644 and its details at the following reference: [link](https://github.com/pulp/pulp_ansible/blob/main/pulp_ansible/app/models.py#L234)