{
    "data_version": "4.0",
    "data_type": "CVE",
    "data_format": "MITRE",
    "CVE_data_meta": {
        "ID": "CVE-2022-3596",
        "ASSIGNER": "secalert@redhat.com",
        "STATE": "PUBLIC"
    },
    "description": {
        "description_data": [
            {
                "lang": "eng",
                "value": "An information leak was found in OpenStack's undercloud. This flaw allows unauthenticated, remote attackers to inspect sensitive data after discovering the IP address of the undercloud, possibly leading to compromising private information, including administrator access credentials."
            }
        ]
    },
    "problemtype": {
        "problemtype_data": [
            {
                "description": [
                    {
                        "lang": "eng",
                        "value": "Transmission of Private Resources into a New Sphere ('Resource Leak')",
                        "cweId": "CWE-402"
                    }
                ]
            }
        ]
    },
    "affects": {
        "vendor": {
            "vendor_data": [
                {
                    "vendor_name": "Red Hat",
                    "product": {
                        "product_data": [
                            {
                                "product_name": "Red Hat OpenStack Platform 13.0 - ELS",
                                "version": {
                                    "version_data": [
                                        {
                                            "version_value": "not down converted",
                                            "x_cve_json_5_version_data": {
                                                "versions": [
                                                    {
                                                        "version": "0:8.4.9-13.el7ost",
                                                        "lessThan": "*",
                                                        "versionType": "rpm",
                                                        "status": "unaffected"
                                                    }
                                                ],
                                                "defaultStatus": "affected"
                                            }
                                        }
                                    ]
                                }
                            },
                            {
                                "product_name": "Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS",
                                "version": {
                                    "version_data": [
                                        {
                                            "version_value": "not down converted",
                                            "x_cve_json_5_version_data": {
                                                "versions": [
                                                    {
                                                        "version": "0:8.4.9-13.el7ost",
                                                        "lessThan": "*",
                                                        "versionType": "rpm",
                                                        "status": "unaffected"
                                                    }
                                                ],
                                                "defaultStatus": "affected"
                                            }
                                        }
                                    ]
                                }
                            }
                        ]
                    }
                }
            ]
        }
    },
    "references": {
        "reference_data": [
            {
                "url": "https://access.redhat.com/errata/RHSA-2022:8897",
                "refsource": "MISC",
                "name": "https://access.redhat.com/errata/RHSA-2022:8897"
            },
            {
                "url": "https://access.redhat.com/security/cve/CVE-2022-3596",
                "refsource": "MISC",
                "name": "https://access.redhat.com/security/cve/CVE-2022-3596"
            },
            {
                "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136596",
                "refsource": "MISC",
                "name": "https://bugzilla.redhat.com/show_bug.cgi?id=2136596"
            }
        ]
    },
    "work_around": [
        {
            "lang": "en",
            "value": "The rsync daemon is no longer needed and can be manually disabled by running the following commands on the undercloud:\n\n    sudo rm /etc/xinetd.d/rsync /etc/rsyncd.conf \n    sudo systemctl restart xinetd\n\nHowever, this will be reverted if the undercloud gets updated."
        }
    ],
    "credits": [
        {
            "lang": "en",
            "value": "Red Hat would like to thank Maciej Relewicz (Juniper Networks) for reporting this issue."
        }
    ],
    "impact": {
        "cvss": [
            {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                "version": "3.1"
            }
        ]
    }
}