CVE-2022-3644

Advisory

Pulp-ansible 0.15.0 includes a fix for CVE-2022-3644: The collection remote for pulp_ansible stores tokens in plaintext instead of using pulp's encrypted field and exposes them in read/write mode via the API () instead of marking it as write only.
https://github.com/pulp/pulp_ansible/pull/1222

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-qv37-mfjf-42h8
• https://nvd.nist.gov/vuln/detail/CVE-2022-3644
• https://github.com/pulp/pulp_ansible/issues/1221
• https://github.com/pulp/pulp_ansible/commit/d13c427b09482a7f598d8ee597d17a8a34888665
• https://github.com/pulp/pulp_ansible
• https://github.com/pulp/pulp_ansible/blob/main/pulp_ansible/app/models.py#L234
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3644