CVE-2022-0852
There is a flaw in convert2rhel. convert2rhel passes the Red Hat account password to subscription...
There is a flaw in convert2rhel. convert2rhel passes the Red Hat account password to subscription-manager via the command line, which could allow unauthorized users locally on the machine to view the password via the process command line via e.g. htop or ps. The specific impact varies upon the privileges of the Red Hat account in question, but it could affect the integrity, availability, and/or data confidentiality of other systems that are administered by that account. This occurs regardless of how the password is supplied to convert2rhel.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
There is a flaw in convert2rhel. convert2rhel passes the Red Hat account password to subscription-manager via the command line, which could allow unauthorized users locally on the machine to view the password via the process command line via e.g. htop or ps. The specific impact varies upon the privileges of the Red Hat account in question, but it could affect the integrity, availability, and/or data confidentiality of other systems that are administered by that account. This occurs regardless of how the password is supplied to convert2rhel.
- Record
CVE-2022-0852- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-359, CWE-668
- Updated
- 2026-11-02
CVE List No score
There is a flaw in convert2rhel. convert2rhel passes the Red Hat account password to subscription-manager via the command line, which could allow unauthorized users locally on the machine to view the password via the process command line via e.g. htop or ps. The specific impact varies upon the privileges of the Red Hat account in question, but it could affect the integrity, availability, and/or data confidentiality of other systems that are administered by that account. This occurs regardless of how the password is supplied to convert2rhel.
- Record
CVE-2022-0852- Weakness
- CWE-359
- Updated
- 2026-11-02
EUVDEUVD-2022-15895 No score
There is a flaw in convert2rhel. convert2rhel passes the Red Hat account password to subscription-manager via the command line, which could allow unauthorized users locally on the machine to view the password via the process command line via e.g. htop or ps. The specific impact varies upon the privileges of the Red Hat account in question, but it could affect the integrity, availability, and/or data confidentiality of other systems that are administered by that account. This occurs regardless of how the password is supplied to convert2rhel.
- Record
EUVD-2022-15895- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fjvj-w876-8mc2
There is a flaw in convert2rhel. convert2rhel passes the Red Hat account password to subscription...
There is a flaw in convert2rhel. convert2rhel passes the Red Hat account password to subscription-manager via the command line, which could allow unauthorized users locally on the machine to view the password via the process command line via e.g. htop or ps. The specific impact varies upon the privileges of the Red Hat account in question, but it could affect the integrity, availability, and/or data confidentiality of other systems that are administered by that account. This occurs regardless of how the password is supplied to convert2rhel.
- Record
GHSA-fjvj-w876-8mc2- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-359, CWE-668
- Updated
- 2026-11-02
OSVRHSA-2022:1599
Red Hat Security Advisory: convert2rhel security update
- Record
RHSA-2022:1599- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - Updated
- 2026-11-02
OSVRHSA-2022:1617
Red Hat Security Advisory: convert2rhel security update
- Record
RHSA-2022:1617- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - Updated
- 2026-11-02
OSVRHSA-2022:1618
Red Hat Security Advisory: convert2rhel security update
- Record
RHSA-2022:1618- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - Updated
- 2026-11-02
OSV No score
There is a flaw in convert2rhel. convert2rhel passes the Red Hat account password to subscription-manager via the command line, which could allow unauthorized users locally on the machine to view the password via the process command line via e.g. htop or ps. The specific impact varies upon the privileges of the Red Hat account in question, but it could affect the integrity, availability, and/or data confidentiality of other systems that are administered by that account. This occurs regardless of how the password is supplied to convert2rhel.
- Record
CVE-2022-0852- Weakness
- CWE-359
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
convert2rhelRed Hat:convert2rhel::el8 |
before 0:0.25-4.el8 | 0:0.25-4.el8 |
convert2rhelRed Hat:convert2rhel::el7 |
before 0:0.25-4.el7 | 0:0.25-4.el7 |
convert2rhelRed Hat:convert2rhel::el6 |
before 0:0.25-4.el6 | 0:0.25-4.el6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-0852 is a medium vulnerability (CVSS 5.5) in Convert2rhel Project Convert2rhel, published August 29, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 30th percentile. Fixed in convert2rhel 0:0.25-4.el8.
References
bugzilla.redhat.com/show_bug.cgi?id=2060129
issues.redhat.com/browse/RHELC-432
github.com/oamg/convert2rhel/pull/492
access.redhat.com/security/cve/CVE-2022-0852
nvd.nist.gov/vuln/detail/CVE-2022-0852
Show 14 moreShow less
security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1599.json
cve.org/CVERecord?id=CVE-2022-0852