Skip to content
Fencer Vulns
medium 5.5

CVE-2022-3644 json

Plaintext storage of tokens in pulp_ansible

published 2022-10-25 4 y ago modified 2026-07-07 4 mo ago also GHSA-qv37-mfjf-42h8 , PYSEC-2026-900 , EUVD-2022-7155

cvss
5.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 23%
public exploits
0
none known

Summary

The collection remote for pulp_ansible stores tokens in plaintext instead of using pulp's encrypted field and exposes them in read/write mode via the API () instead of marking it as write only.

Patch / fix

  • pypi pulp-ansible 0.15.0
  • foreman satellite utils 6.14, satellite capsule 6.14, satellite 6.14 3.7.0.9-1.el8sat
  • foreman-cli satellite utils 6.14, satellite 6.14 3.7.0.9-1.el8sat
  • foreman-ec2 satellite 6.14 3.7.0.9-1.el8sat
  • rubygem-git satellite 6.14 1.18.0-1.el8sat
  • puppet-agent satellite capsule 6.14, satellite 6.14 7.26.0-3.el8sat
  • puppetserver satellite capsule 6.14, satellite 6.14 7.11.0-1.el8sat
  • rubygem-rack satellite capsule 6.14, satellite 6.14 2.2.7-1.el8sat
  • foreman-ovirt satellite 6.14 3.7.0.9-1.el8sat

red hat advisories RHSA-2023:6818

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-3644 updated cvss 4.1

Pulp: Tokens stored in plaintext

  • Red Hat Ansible Automation Platform 2 python-pulp-ansible
    affected: no fix planned “Will not fix”
  • Red Hat Update Infrastructure 3 for Cloud Providers pulp
    affected: no fix available
  • Red Hat Satellite 6.14 for RHEL 8 python-pulp-ansible 0.16.0-1.el8pc, python39-pulp-ansible 0.16.0-1.el8pc
    fixed: vendor fix RHSA-2023:6818
  • Red Hat Satellite 6.14 for RHEL 8 cjson 1.7.14-5.el8sat, katello 4.9.0-1.el8sat, libsolv 0.7.22-4.el8pc, libcomps 0.1.18-4.el8pc, python-idna 3.3-2.el8pc, candlepin 4.3.1-1.el8sat, +667 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
18 mo ago

Exploit prediction

0.30% chance of exploitation in the next 30 days, higher than 23% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/pulp/pulp_ansible/blob/main/pulp_ansible/app/models.py#L234 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CNA 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
GitHub 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
OSV 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
pypi pulp-ansible
<0.15.0
0.15.0

Affected products

  • n/a pulp_ansible

Classification

Weakness
  • CWE-256 Plaintext Storage of a Password
  • CWE-522 Insufficiently Protected Credentials

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.