Incorrect Permission Assignment for Critical Resource Affecting tripleo-ansible package, versions [0,]
Threat Intelligence
EPSS
0.05% (17th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-TRIPLEOANSIBLE-3370256
- published 24 Mar 2023
- disclosed 23 Mar 2023
- credit Unknown
Introduced: 23 Mar 2023
CVE-2022-3146 Open this link in a new tabHow to fix?
There is no fixed version for tripleo-ansible.
Overview
tripleo-ansible is an Ansible assets for the TripleO project.
Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource such that the permissions of a sensitive file are not sufficiently restricted due to an insecure default configuration. This flaw allows a local attacker to use brute force to explore the relevant directory and discover the file. This issue leads to information disclosure of important configuration details from the OpenStack deployment.
References
CVSS Scores
version 3.1