PT-2021-20387 · Red Hat · Tfm-Rubygem-Foreman Azure Rm

Evgeni Golov + 1 · Published 2021-04-08 · Updated 2021-04-14 · CVE-2021-3413

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Red Hat Satellite tfm-rubygem-foreman azure rm versions prior to 2.2.0

Description: A flaw in Red Hat Satellite's tfm-rubygem-foreman azure rm component can lead to a credential leak, exposing Azure Resource Manager's secret key through JSON in the API output. This issue primarily threatens data confidentiality and integrity, as well as system availability.

Recommendations: For versions prior to 2.2.0, update to version 2.2.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the API output to minimize the risk of credential exposure.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2021-3413

RHSA-2021:4702

Affected Products

Tfm-Rubygem-Foreman Azure Rm

References · 3

• https://osv.dev/vulnerability/CVE-2021-3413 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3413 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1930352 · Note