Insufficiently protected credentials in convert2rhel - CVE-2022-0852
Published: April 27, 2022 / Updated: June 6, 2022
Vulnerability identifier: #VU62654
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-0852
CWE-ID: CWE-522
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to the convert2rhel passes the Red Hat account password to subscription-manager via the command line. A local user with ability to view process list can obtain the Red Hat account password and gain unauthorized access to the victim's Red Hat account.
Affected software
convert2rhel
How to mitigate CVE-2022-0852
Install update from vendor's website.
convert2rhel - update to 0.26