medium5.5
CVE-2022-3101
tripleo-ansible may disclose important configuration details from an OpenStack deployment
Impact
A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw allows a local attacker to use brute force to explore the relevant directory and discover the file, leading to information disclosure of important configuration details from the OpenStack deployment.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | tripleo-ansible | <= 6.0.0 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Openstack | Tripleo Ansible | All versions |
| Redhat | Openstack | Versions 16.1, 16.2 |
| Redhat | Openstack For Ibm Power | Versions 16.1, 16.2 |