CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2020-10716 – rubygem-foreman_ansible: "User input" entry from Job Invocation may contain sensitive data
https://notcve.org/view.php?id=CVE-2020-10716
A flaw was found in Red Hat Satellite's Job Invocation, where the "User Input" entry was not properly restricted to the view. This flaw allows a malicious Satellite user to scan through the Job Invocation, with the ability to search for passwords and other sensitive data. This flaw affects tfm-rubygem-foreman_ansible versions before 4.0.3.4. Se encontró un fallo en Job Invocation de Red Hat Satellite, donde la entrada "User Input" no estaba restringida apropiadamente a la visualización. Este fallo permite a un usuario de Satellite malicioso escanear por medio del Job Invocation, con la capacidad de buscar contraseñas y otros datos confidenciales. • https://bugzilla.redhat.com/show_bug.cgi?id=1814998 https://bugzilla.redhat.com/show_bug.cgi?id=1827300 https://access.redhat.com/security/cve/CVE-2020-10716 • CWE-285: Improper Authorization •
CVSS: 7.1EPSS: 0%CPEs: 2EXPL: 0CVE-2020-10709
https://notcve.org/view.php?id=CVE-2020-10709
A security flaw was found in Ansible Tower when requesting an OAuth2 token with an OAuth2 application. Ansible Tower uses the token to provide authentication. This flaw allows an attacker to obtain a refresh token that does not expire. The original token granted to the user still has access to Ansible Tower, which allows any user that can gain access to the token to be fully authenticated to Ansible Tower. This flaw affects Ansible Tower versions before 3.6.4 and Ansible Tower versions before 3.5.6. • https://bugzilla.redhat.com/show_bug.cgi?id=1824033 • CWE-287: Improper Authentication CWE-613: Insufficient Session Expiration •
CVSS: 3.3EPSS: 0%CPEs: 3EXPL: 0CVE-2020-10698
https://notcve.org/view.php?id=CVE-2020-10698
A flaw was found in Ansible Tower when running jobs. This flaw allows an attacker to access the stdout of the executed jobs which are run from other organizations. Some sensible data can be disclosed. However, critical data should not be disclosed, as it should be protected by the no_log flag when debugging is enabled. This flaw affects Ansible Tower versions before 3.6.4, Ansible Tower versions before 3.5.6 and Ansible Tower versions before 3.4.6. • https://bugzilla.redhat.com/show_bug.cgi?id=1818924 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.4EPSS: 0%CPEs: 3EXPL: 0CVE-2020-10697
https://notcve.org/view.php?id=CVE-2020-10697
A flaw was found in Ansible Tower when running Openshift. Tower runs a memcached, which is accessed via TCP. An attacker can take advantage of writing a playbook polluting this cache, causing a denial of service attack. This attack would not completely stop the service, but in the worst-case scenario, it can reduce the Tower performance, for which memcached is designed. Theoretically, more sophisticated attacks can be performed by manipulating and crafting the cache, as Tower relies on memcached as a place to pull out setting values. • https://bugzilla.redhat.com/show_bug.cgi?id=1818445 • CWE-862: Missing Authorization •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2021-3447 – ansible: multiple modules expose secured values
https://notcve.org/view.php?id=CVE-2021-3447
A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged in plain-text on managed nodes, as well as being made visible on the controller node when run in verbose mode. These parameters were not protected by the no_log feature. An attacker can take advantage of this information to steal those credentials, provided when they have access to the log files containing them. The highest threat from this vulnerability is to data confidentiality. This flaw affects Red Hat Ansible Automation Platform in versions before 1.2.2 and Ansible Tower in versions before 3.8.2. • https://bugzilla.redhat.com/show_bug.cgi?id=1939349 https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MS4VPUYVLGSAKOX26IT52BSMEZRZ3KS https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JBZ75MAMVQVZROPYHMRDQKPPVASP63DG https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RUTGO4RS4ZXZSPBU2CHVPT75IAFVTTL3 https://access.redhat.com/security/cve/CVE-2 • CWE-532: Insertion of Sensitive Information into Log File •