Convert2rhel is a Red Hat utility for in-place conversion of Linux systems from CentOS or Oracle Linux to Red Hat Enterprise Linux, operating as a narrowly scoped but systemically sensitive migration tool. Its disclosed vulnerabilities center on exposure of sensitive information and private configuration data to unauthorized actors, reflecting the access to system state and credentials required during OS conversion workflows. Current exploitation activity and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Convert2rhel Project over time
Signals from CVEs in this vendor scope (3 CVEs).
3 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-0851MEDIUM There is a flaw in convert2rhel. When the --activationkey option is used with convert2rhel, the activation key is subsequently passed to subscription-manager via the command line, | Aug 29, 2022 | 5.5 | 20 | NO | NO |
CVE-2022-1662MEDIUM In convert2rhel, there's an ansible playbook named ansible/run-convert2rhel.yml which passes the Red Hat Subscription Manager user password via the CLI to convert2rhel. This could | Jul 14, 2022 | 5.5 | 17 | NO | NO |
CVE-2022-0852MEDIUM There is a flaw in convert2rhel. convert2rhel passes the Red Hat account password to subscription-manager via the command line, which could allow unauthorized users locally on the | Aug 29, 2022 | 5.5 | 16 | NO | NO |
Signals from CVEs in this vendor scope (3 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Convert2rhel Project.
Media articles that mention a CVE ID that affects a product developed by Convert2rhel Project — matched by CVE ID, not by vendor name.