CVE-2022-3644: Plaintext Storage of a Password

October 25, 2022

The collection remote for pulp_ansible stores tokens in plaintext instead of using pulp’s encrypted field and exposes them in read/write mode via the API () instead of marking it as write only.

References

github.com/advisories/GHSA-qv37-mfjf-42h8
github.com/pulp/pulp_ansible/blob/main/pulp_ansible/app/models.py
github.com/pulp/pulp_ansible/commit/d13c427b09482a7f598d8ee597d17a8a34888665
github.com/pulp/pulp_ansible/issues/1221
nvd.nist.gov/vuln/detail/CVE-2022-3644

Code Behaviors & Features

Detect and mitigate CVE-2022-3644 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →