What is CVE-2022-1662?

CVE-2022-1662 is a vulnerability in convert2rhel where the Red Hat Subscription Manager user password is passed via the CLI to convert2rhel, allowing unauthorized local users to view the password via the process list while convert2rhel is running.

What is the severity of CVE-2022-1662?

The severity of CVE-2022-1662 is medium with a severity value of 5.5.

How does CVE-2022-1662 affect convert2rhel?

CVE-2022-1662 affects convert2rhel versions 0.24, 0.25, and up to exclusive version 0.26.

How can this vulnerability be fixed?

To fix CVE-2022-1662, it is recommended to upgrade to convert2rhel version 0.26 or apply the necessary patches provided by Red Hat.

Where can I find more information about CVE-2022-1662?

More information about CVE-2022-1662 can be found at the following references: [Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=2083851) and [GitHub](https://github.com/oamg/convert2rhel/commit/01a6d5596c88118b871f849077f4ffd44ba9e5aa).

Vulnerability/
CVE-2022-1662

medium

5.5

CWE

200

10/5/2022

14/7/2022

3/8/2024

CVE-2022-1662: Infoleak

First published: Tue May 10 2022(Updated: )

In convert2rhel 0.24 and 0.25, there's an ansible playbook named ansible/run-convert2rhel.yml which passes the Red Hat Subscription Manager user password via the CLI to convert2rhel. This could allow unauthorized local users to view the password via the process list while convert2rhel is running. However, this ansible playbook is only an example in the upstream repository and it is not shipped in officially supported versions of convert2rhel. Commit that introduced the flaw: <a href="https://github.com/oamg/convert2rhel/commit/01a6d5596c88118b871f849077f4ffd44ba9e5aa">https://github.com/oamg/convert2rhel/commit/01a6d5596c88118b871f849077f4ffd44ba9e5aa</a> Upstream patch: <a href="https://github.com/oamg/convert2rhel/pull/493/commits/15cace456d06f31e7ddb7cdb443bd2cc8a1614e1">https://github.com/oamg/convert2rhel/pull/493/commits/15cace456d06f31e7ddb7cdb443bd2cc8a1614e1</a>

Credit: secalert@redhat.com

Affected Software	Affected Version	How to fix
redhat/convert2rhel	<0.26	0.26
Convert2rhel Project Convert2rhel	=0.24
Convert2rhel Project Convert2rhel	=0.25

Remedy

https://bugzilla.redhat.com/show_bug.cgi?id=2083851

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is CVE-2022-1662?
CVE-2022-1662 is a vulnerability in convert2rhel where the Red Hat Subscription Manager user password is passed via the CLI to convert2rhel, allowing unauthorized local users to view the password via the process list while convert2rhel is running.
What is the severity of CVE-2022-1662?
The severity of CVE-2022-1662 is medium with a severity value of 5.5.
How does CVE-2022-1662 affect convert2rhel?
CVE-2022-1662 affects convert2rhel versions 0.24, 0.25, and up to exclusive version 0.26.
How can this vulnerability be fixed?
To fix CVE-2022-1662, it is recommended to upgrade to convert2rhel version 0.26 or apply the necessary patches provided by Red Hat.
Where can I find more information about CVE-2022-1662?
More information about CVE-2022-1662 can be found at the following references: [Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=2083851) and [GitHub](https://github.com/oamg/convert2rhel/commit/01a6d5596c88118b871f849077f4ffd44ba9e5aa).

collector/nvd-index
agent/references
agent/type
agent/softwarecombine
agent/first-publish-date
collector/mitre-cve
source/MITRE
agent/author
agent/severity
agent/weakness
agent/remedy
agent/last-modified-date
agent/description
collector/redhat-bugzilla
source/Red Hat
alias/CVE-2022-1662
agent/software-canonical-lookup
agent/tags
agent/event
vendor/convert2rhel project
canonical/convert2rhel project convert2rhel
version/convert2rhel project convert2rhel/0.24
version/convert2rhel project convert2rhel/0.25
package-manager/redhat