In convert2rhel's subscription.py file, code to register a system passes the password via the commandline. This could result in disclosure of the password to all users with local access to the system.

Reference:

1. https://github.com/oamg/convert2rhel/blob/main/convert2rhel/subscription.py#L156

In convert2rhel 0.24 and 0.25, there's an ansible playbook named ansible/run-convert2rhel.yml which passes the Red Hat Subscription Manager user password via the CLI to convert2rhel. This could allow unauthorized local users to view the password via the process list while convert2rhel is running. However, this ansible playbook is only an example in the upstream repository and it is not shipped in officially supported versions of convert2rhel.

Commit that introduced the flaw: https://github.com/oamg/convert2rhel/commit/01a6d5596c88118b871f849077f4ffd44ba9e5aa Upstream patch: https://github.com/oamg/convert2rhel/pull/493/commits/15cace456d06f31e7ddb7cdb443bd2cc8a1614e1

In convert2rhel's subscription.py file, code to register a system passes the activation key via the commandline. This could result in disclosure of the activation key to all users with local access to the system.

Reference:

1. https://github.com/oamg/convert2rhel/blob/main/convert2rhel/subscription.py#L135