CVE-2022-3146: tripleo-ansible may disclose important configuration details from an OpenStack deployment

March 23, 2023 (updated November 7, 2023)

A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw allows a local attacker to use brute force to explore the relevant directory and discover the file. This issue leads to information disclosure of important configuration details from the OpenStack deployment.

References

access.redhat.com/security/cve/CVE-2022-3146
github.com/advisories/GHSA-w4x6-6w3r-9h2m
nvd.nist.gov/vuln/detail/CVE-2022-3146

Detect and mitigate CVE-2022-3146 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →