Inclusion of Sensitive Information in Log Files in Ansible - CVE-2021-20228

Vulnerability identifier: #VU50818

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-20228

CWE-ID: CWE-532

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to software stores sensitive information into log files in the Ansible Engine|. A local user can read the log files and gain access to sensitive data.

Ansible
Arch Linux
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Manager Server
SUSE Manager Proxy
SUSE Linux Enterprise Module for SUSE Manager Server
SUSE Linux Enterprise Module for SUSE Manager Proxy
SUSE Linux Enterprise Micro
SUSE Manager Client Tools Beta for SLE Micro
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Power, little endian
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
HPE Helion Openstack
SUSE Manager Tools
SUSE Linux Enterprise Server for SAP Applications
SUSE Manager Client Tools Beta for SLE
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Server for SAP
openSUSE Leap
Ansible Automation Platform
ansible (Debian package)
firewalld-prometheus-config
dracut-saltboot
golang-github-QubitProducts-exporter_exporter
wire-debuginfo
wire
prometheus-postgres_exporter
prometheus-blackbox_exporter
golang-github-lusitaniae-apache_exporter
golang-github-lusitaniae-apache_exporter-debuginfo
python3-zypp-plugin-spacewalk
zypp-plugin-spacewalk
supportutils-plugin-salt
golang-github-prometheus-node_exporter
ovirt-ansible-collection (Red Hat package)
golang-github-boynux-squid_exporter
golang-github-boynux-squid_exporter-debuginfo
python3-hwdata
python2-hwdata
ansible
ansible-test
ansible-doc
golang-github-prometheus-prometheus
python3-uyuni-common-libs
mgr-daemon
uyuni-proxy-systemd-services
mgr-virtualization-host
python3-mgr-virtualization-common
python3-mgr-virtualization-host
spacewalk-client-tools
spacewalk-client-setup
spacewalk-check
python3-spacewalk-client-tools
python3-spacewalk-client-setup
python3-spacewalk-check
spacecmd
rubygem-ovirt-engine-sdk4 (Red Hat package)
python-ovirt-engine-sdk4 (Red Hat package)
python3-mgr-push
mgr-push
supportutils-plugin-susemanager-client
python3-rhnlib
python3-pyvmomi
grafana
grafana-debuginfo
Red Hat Virtualization Manager

Install updates from vendor's website.

Ansible - addressed in versions 2.10.6, 2.9.18-1.el7ae, 2.9.18-1.el8ae
Ansible Automation Platform - update to 1.2.4
ansible (Debian package) - update to 2.7.7+dfsg-1+deb10u1
firewalld-prometheus-config - update to 0.1-159000.6.33.1
dracut-saltboot - addressed in versions 0.1.1657643023.0d694ce-150000.1.35.1, 0.1.1681904360.84ef141-159000.3.30.1
golang-github-QubitProducts-exporter_exporter - addressed in versions 0.4.0-150000.1.15.1, 0.4.0-159000.4.6.1
wire-debuginfo - update to 0.5.0-150000.1.6.1
wire - update to 0.5.0-150000.1.6.1
prometheus-postgres_exporter - update to 0.10.1-159000.3.6.1
prometheus-blackbox_exporter - addressed in versions 0.19.0-150000.1.11.1, 0.24.0-159000.3.6.1
golang-github-lusitaniae-apache_exporter - update to 1.0.0-159000.4.12.1
golang-github-lusitaniae-apache_exporter-debuginfo - update to 1.0.0-159000.4.12.1
python3-zypp-plugin-spacewalk - update to 1.0.13-150000.3.32.1
zypp-plugin-spacewalk - update to 1.0.13-150000.3.32.1
supportutils-plugin-salt - update to 1.2.2-159000.5.9.1
golang-github-prometheus-node_exporter - update to 1.3.0-150000.3.15.1
ovirt-ansible-collection (Red Hat package) - update to 1.4.2-1.el8ev
golang-github-boynux-squid_exporter - update to 1.6-159000.4.9.1
golang-github-boynux-squid_exporter-debuginfo - update to 1.6-159000.4.9.1
python3-hwdata - addressed in versions 2.3.5-150000.3.9.1, 2.3.5-159000.5.13.1
python2-hwdata - update to 2.3.5-150000.3.9.1
ansible - addressed in versions 2.9.22-3.18.1, 2.9.27-150000.1.14.1, 2.9.27-159000.3.9.1
ansible-test - update to 2.9.27-150000.1.14.1
ansible-doc - addressed in versions 2.9.27-150000.1.14.1, 2.9.27-159000.3.9.1
golang-github-prometheus-prometheus - update to 2.45.0-159000.6.33.1
python3-uyuni-common-libs - addressed in versions 4.3.5-150000.1.24.1, 5.0.1-159000.3.33.1
mgr-daemon - update to 4.3.5-150000.1.35.1
uyuni-proxy-systemd-services - addressed in versions 4.3.6-150000.1.6.1, 5.0.1-159000.3.9.1
mgr-virtualization-host - update to 4.3.6-150000.1.32.1
python3-mgr-virtualization-common - update to 4.3.6-150000.1.32.1
python3-mgr-virtualization-host - update to 4.3.6-150000.1.32.1
spacewalk-client-tools - addressed in versions 4.3.11-150000.3.65.1, 5.0.1-159000.6.48.1
spacewalk-client-setup - addressed in versions 4.3.11-150000.3.65.1, 5.0.1-159000.6.48.1
spacewalk-check - addressed in versions 4.3.11-150000.3.65.1, 5.0.1-159000.6.48.1
python3-spacewalk-client-tools - addressed in versions 4.3.11-150000.3.65.1, 5.0.1-159000.6.48.1
python3-spacewalk-client-setup - addressed in versions 4.3.11-150000.3.65.1, 5.0.1-159000.6.48.1
python3-spacewalk-check - addressed in versions 4.3.11-150000.3.65.1, 5.0.1-159000.6.48.1
spacecmd - addressed in versions 4.3.14-150000.3.83.1, 5.0.1-159000.6.42.1
rubygem-ovirt-engine-sdk4 (Red Hat package) - update to 4.4.1-1.el8ev
python-ovirt-engine-sdk4 (Red Hat package) - update to 4.4.12-1.el8ev
python3-mgr-push - update to 5.0.1-159000.4.21.1
mgr-push - update to 5.0.1-159000.4.21.1
supportutils-plugin-susemanager-client - update to 5.0.1-159000.6.15.1
python3-rhnlib - update to 5.0.1-159000.6.30.1
python3-pyvmomi - update to 6.7.3-159000.3.6.1
grafana - update to 9.5.8-159000.4.24.1
grafana-debuginfo - update to 9.5.8-159000.4.24.1

• https://bugzilla.redhat.com/show_bug.cgi?id=1925002
• https://github.com/ansible/ansible/pull/73487
• https://github.com/ansible/ansible/commit/e41d1f0a3fd6c466192e7e24accd3d1c6501111b

• Information disclosure in Red Hat Ansible
• Arch Linux update for ansible-base
• Red Hat update for Ansible Engine
• Red Hat update for Ansible Engine
• Red Hat update for ansible
• Debian update for ansible
• SUSE update for ansible
• SUSE update for Important for SUSE Manager Client Tools
• Multiple vulnerabilities in Red Hat Ansible Automation Platform 1.2
• SUSE update for Security Beta update for SUSE Manager Client Tools and Salt