PT-2022-10553 · Red Hat · Ansible Galaxy Collections

Published 2022-04-18 · Updated 2022-04-27 · CVE-2021-3681

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ansible Galaxy Collections (affected versions not specified)

Description A flaw was found in Ansible Galaxy Collections. When collections are built manually, any files in the repository directory that are not explicitly excluded via the build ignore list in "galaxy.yml" are included in the .tar.gz file. This contains sensitive information, such as the user's Ansible Galaxy API key and any secrets in ansible or ansible-playbook verbose output without the no log redaction. Currently, there is no way to deprecate a Collection or delete a Collection Version. Once published, anyone who downloads or installs the collection can view the secrets.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2021-3681

Affected Products

Ansible Galaxy Collections

References · 5

• https://osv.dev/vulnerability/CVE-2021-3681 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1989407 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3681 · Security Note
• https://github.com/ansible/galaxy/issues/1977 · Note
• https://t.me/cibsecurity/41048 · Telegram Post