CVE-2022-3146
Fixed in a distro release EPSS <1%
A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw allows a local attacker to use brute force to explore the relevant directory and discover the file. This issue leads to information disclosure of important configuration details from the OpenStack deployment.
Products: openstack tripleo_ansible, redhat openstack, redhat openstack_for_ibm_power
Affected upstream, no fix yet
| Ecosystem | Package |
|---|---|
| PyPI | tripleo-ansible |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat openstack 16.1 | python3-tripleo-common | 0:11.4.1-1.20211201113404.el8ost |
| Red Hat openstack 16.1 | tripleo-ansible | 0:0.5.1-1.20220114163454.el8ost |
| Red Hat openstack 16.2 | python3-tripleo-common | 0:11.7.1-2.20220318011206.el8ost |
| Red Hat openstack 16.2 | tripleo-ansible | 0:0.8.1-2.20220406160116.el8ost |