Exposure of Resource to Wrong Sphere in convert2rhel - CVE-2022-0851
Published: August 31, 2022
Vulnerability identifier: #VU66893
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-0851
CWE-ID: CWE-668
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to the activation key is subsequently passed to subscription-manager via the command line when the --activationkey option is used with convert2rhel. A local user can view the list of running processes on the system and obtain the activation key.
Affected software
convert2rhel
convert2rhel (Red Hat package)
convert2rhel (Red Hat package)
How to mitigate CVE-2022-0851
Install updates from vendor's website.
convert2rhel - update to 1.0
convert2rhel (Red Hat package) - addressed in versions 1.0-1.el6, 1.0-1.el7, 1.0-1.el8
convert2rhel (Red Hat package) - addressed in versions 1.0-1.el6, 1.0-1.el7, 1.0-1.el8