CVE-2021-3681

A flaw was found in Ansible Galaxy Collections. When collections are built manually, any files in the repository directory that are not explicitly excluded via the ``build_ignore`` list in "galaxy.yml" include files in the ``.tar.gz`` file. This contains sensitive info, such as the user's Ansible Galaxy API key and any secrets in ``ansible`` or ``ansible-playbook`` verbose output without the``no_log`` redaction. Currently, there is no way to deprecate a Collection Or delete a Collection Version. Once published, anyone who downloads or installs the collection can view the secrets.

CVSS v3 5.5 MEDIUM
CVSS v2.0 2.1 LOW

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

2.1^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://bugzilla.redhat.com/show_bug.cgi?id=1989407	Issue Tracking Vendor Advisory
https://github.com/ansible/galaxy/issues/1977	Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1989407	Issue Tracking Vendor Advisory
https://github.com/ansible/galaxy/issues/1977	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:redhat:ansible_automation_platform:1.2:::::::*
	cpe:2.3:a:redhat:ansible_galaxy:3.3.0:::::::*

History

21 Nov 2024, 06:22

Type	Values Removed	Values Added
References	~~() https://bugzilla.redhat.com/show_bug.cgi?id=1989407 - Issue Tracking, Vendor Advisory~~	() https://bugzilla.redhat.com/show_bug.cgi?id=1989407 - Issue Tracking, Vendor Advisory
References	~~() https://github.com/ansible/galaxy/issues/1977 - Third Party Advisory~~	() https://github.com/ansible/galaxy/issues/1977 - Third Party Advisory

Information

Published : 2022-04-18 17:15

Updated : 2024-11-21 06:22

NVD link : CVE-2021-3681

Mitre link : CVE-2021-3681

CVE.ORG link : CVE-2021-3681

JSON object : View

Products Affected

redhat

ansible_galaxy
ansible_automation_platform

CWE

CWE-522

Insufficiently Protected Credentials

{"id": "CVE-2021-3681", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2022-04-18T17:15:15.507", "references": [{"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1989407", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://github.com/ansible/galaxy/issues/1977", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1989407", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/ansible/galaxy/issues/1977", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-522"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-522"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in Ansible Galaxy Collections. When collections are built manually, any files in the repository directory that are not explicitly excluded via the ``build_ignore`` list in \"galaxy.yml\" include files in the ``.tar.gz`` file. This contains sensitive info, such as the user's Ansible Galaxy API key and any secrets in ``ansible`` or ``ansible-playbook`` verbose output without the``no_log`` redaction. Currently, there is no way to deprecate a Collection Or delete a Collection Version. Once published, anyone who downloads or installs the collection can view the secrets."}, {"lang": "es", "value": "Se ha encontrado un fallo en Ansible Galaxy Collections. Cuando las colecciones son construidas manualmente, cualquier archivo en el directorio del repositorio que no sea excluido expl\u00edcitamente por medio de la lista \"build_ignore\" en \"galaxy.yml\" incluye archivos en el archivo \".tar.gz\". Esto contiene informaci\u00f3n confidencial, como la clave de la API de Ansible Galaxy del usuario y cualquier secreto en la salida verbosa de \"ansible\" o \"ansible-playbook\" sin la redacci\u00f3n \"no_log\". Actualmente, no se presenta forma de eliminar una colecci\u00f3n o una versi\u00f3n de la colecci\u00f3n. Una vez publicada, cualquiera que descargue o instale la colecci\u00f3n puede visualizar los secretos"}], "lastModified": "2024-11-21T06:22:08.930", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:ansible_automation_platform:1.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CBA4F8F3-6FC3-4ADD-BB96-A707E94AB0AB"}, {"criteria": "cpe:2.3:a:redhat:ansible_galaxy:3.3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1690AEF3-1BBC-40FE-9B89-AD11691269B7"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}