CVE-2022-3101: tripleo-ansible may disclose important configuration details from an OpenStack deployment

March 23, 2023 (updated November 7, 2023)

A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw allows a local attacker to use brute force to explore the relevant directory and discover the file, leading to information disclosure of important configuration details from the OpenStack deployment.

References

access.redhat.com/security/cve/CVE-2022-3101
github.com/advisories/GHSA-7x96-2w32-w3gw
nvd.nist.gov/vuln/detail/CVE-2022-3101

Code Behaviors & Features

Detect and mitigate CVE-2022-3101 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →