CVE-2021-3447

Description

A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged in plain-text on managed nodes, as well as being made visible on the controller node when run in verbose mode. These parameters were not protected by the no_log feature. An attacker can take advantage of this information to steal those credentials, provided when they have access to the log files containing them. The highest threat from this vulnerability is to data confidentiality. This flaw affects Red Hat Ansible Automation Platform in versions before 1.2.2 and Ansible Tower in versions before 3.8.2.

Risk Information

Base Score

5.5

MODERATE

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS Score

Exploitation Probability

0.072

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2021-3447 are fixed in Python-ansible 1.2.2	Windows
(RHSA-2021:2866) RHV Engine and Host Common Packages security update [ovirt-4.4.7] ovirt-ansible-collection-1.5.3-1.el8ev.noarch.rpm	Linux
(RHSA-2021:2866) RHV Engine and Host Common Packages security update [ovirt-4.4.7] python-ovirt-engine-sdk4-debugsource-4.4.13-1.el8ev.x86_64.rpm	Linux
(RHSA-2021:2866) RHV Engine and Host Common Packages security update [ovirt-4.4.7] python3-ovirt-engine-sdk4-4.4.13-1.el8ev.x86_64.rpm	Linux
Vulnerabilities CVE-2021-3447 are fixed in Python-ansible for linux 1.2.2	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234