CVE-2022-1662: Infoleak
In convert2rhel 0.24 and 0.25, there's an ansible playbook named ansible/run-convert2rhel.yml which passes the Red Hat Subscription Manager user password via the CLI to convert2rhel. This could allow unauthorized local users to view the password via the process list while convert2rhel is running. However, this ansible playbook is only an example in the upstream repository and it is not shipped in officially supported versions of convert2rhel.
Commit that introduced the flaw: https://github.com/oamg/convert2rhel/commit/01a6d5596c88118b871f849077f4ffd44ba9e5aa Upstream patch: https://github.com/oamg/convert2rhel/pull/493/commits/15cace456d06f31e7ddb7cdb443bd2cc8a1614e1
Other sources
In convert2rhel, there's an ansible playbook named ansible/run-convert2rhel.yml which passes the Red Hat Subscription Manager user password via the CLI to convert2rhel. This could allow unauthorized local users to view the password via the process list while convert2rhel is running. However, this ansible playbook is only an example in the upstream repository and it is not shipped in officially supported versions of convert2rhel.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2022-1662?
CVE-2022-1662 is a vulnerability in convert2rhel where the Red Hat Subscription Manager user password is passed via the CLI to convert2rhel, allowing unauthorized local users to view the password via the process list while convert2rhel is running.
What is the severity of CVE-2022-1662?
The severity of CVE-2022-1662 is medium with a severity value of 5.5.
How does CVE-2022-1662 affect convert2rhel?
CVE-2022-1662 affects convert2rhel versions 0.24, 0.25, and up to exclusive version 0.26.
How can this vulnerability be fixed?
To fix CVE-2022-1662, it is recommended to upgrade to convert2rhel version 0.26 or apply the necessary patches provided by Red Hat.
Where can I find more information about CVE-2022-1662?
More information about CVE-2022-1662 can be found at the following references: [Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=2083851) and [GitHub](https://github.com/oamg/convert2rhel/commit/01a6d5596c88118b871f849077f4ffd44ba9e5aa).