Vulnerability · Published Aug 29, 2022 · Assigned by redhat

CVE-2022-0851

Medium 5.5

In plain English

A medium-severity information exposure in convert2rhel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).

Severity (CVSS NVD)5.5Medium

Exploit odds (30 days)0.3%top 75.4% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

There is a flaw in convert2rhel. When the --activationkey option is used with convert2rhel, the activation key is subsequently passed to subscription-manager via the command line, which could allow unauthorized users locally on the machine to view the activation key via the process command line via e.g. htop or ps. The specific impact varies upon the subscription, but generally this would allow an attacker to register systems purchased by the victim until discovered; a form of fraud. This could occur regardless of how the activation key is supplied to convert2rhel because it involves how convert2rhel provides it to subscription-manager.

Affected products (as reported)

Vendor	Product	Versions
n/a	convert2rhel	Not-Known

Weakness: CWE-200

References

https://bugzilla.redhat.com/show_bug.cgi?id=2060217 x_refsource_MISC
https://access.redhat.com/security/cve/CVE-2022-0851 x_refsource_MISC