CVE-2022-2568

Ansible: Logic flaw leads to privilage escalation

A privilege escalation flaw was found in the Ansible Automation Platform. This flaw allows a remote authenticated user with 'change user' permissions to modify the account settings of the superuser account and also remove the superuser privileges.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Ansible Automation Platform Enterprise Linux

CVE-2022-1632

Openshift: ClusterIP Service TLS certificate not checked by route controller if re-encrypt Route destinationCACertificate field is explicitly set to default serviceCA

An Improper Certificate Validation attack was found in Openshift. A re-encrypt Route with destinationCACertificate explicitly set to the default serviceCA skips internal Service TLS certificate validation. This flaw allows an attacker to exploit an invalid certificate, resulting in a loss of confidentiality.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Redhat

Products

Fedora Ansible Automation Platform Openshift Container Platform

CVE-2021-4112

ansible-tower: Privilege escalation via job isolation escape

A flaw was found in ansible-tower where the default installation is vulnerable to job isolation escape. This flaw allows an attacker to elevate the privilege from a low privileged user to an AWX user from outside the isolated environment.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Ansible Automation Platform Ansible Automation Platform Early Access Ansible Automation Platform Text-only Advisories and 2 more

CVE-2021-4041

Ansible: Improper shell escaping in ansible-runner

A flaw was found in ansible-runner. An improper escaping of the shell command, while calling the ansible_runner.interface.run_command, can lead to parameters getting executed as host's shell command. A developer could unintentionally write code that gets executed in the host rather than the virtual environment.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Ansible Automation Platform Ansible Runner

CVE-2021-3681

ansible: Secrets leakage vulnerability with ansible collections and ansible galaxy

A flaw was found in Ansible Galaxy Collections. When collections are built manually, any files in the repository directory that are not explicitly excluded via the ``build_ignore`` list in "galaxy.yml" include files in the ``.tar.gz`` file. This contains sensitive info, such as the user's Ansible Galaxy API key and any secrets in ``ansible`` or ``ansible-playbook`` verbose output without the``no_log`` redaction. Currently, there is no way to deprecate a Collection Or delete a Collection Version. Once published, anyone who downloads or installs the collection can view the secrets.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Ansible Automation Platform Ansible Galaxy

CVE-2021-3583

ansible: Template Injection through yaml multi-line strings with ansible facts used in template.

A flaw was found in Ansible, where a user's controller is vulnerable to template injection. This issue can occur through facts used in the template if the user is trying to put templates in multi-line YAML strings and the facts being handled do not routinely include special template characters. This flaw allows attackers to perform command injection, which discloses sensitive information. The highest threat from this vulnerability is to confidentiality and integrity.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Ansible Automation Platform Ansible Engine Ansible Tower

CVE-2021-3447

ansible: multiple modules expose secured values

A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged in plain-text on managed nodes, as well as being made visible on the controller node when run in verbose mode. These parameters were not protected by the no_log feature. An attacker can take advantage of this information to steal those credentials, provided when they have access to the log files containing them. The highest threat from this vulnerability is to data confidentiality. This flaw affects Red Hat Ansible Automation Platform in versions before 1.2.2 and Ansible Tower in versions before 3.8.2.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Redhat

Products

Fedora Ansible Ansible Automation Platform and 4 more

CVE-2021-3281

django: Potential directory-traversal via archive.extract()

In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" and "startproject --template") allows directory traversal via an archive with absolute paths or relative paths with dot segments.

CVSS 3.1 · 5.3 Medium EPSS 7.6% KEV · Not listed

Vendors

Djangoproject Fedoraproject Netapp and 1 more

Products

Django Fedora Snapcenter and 2 more

CVE-2021-33503

python-urllib3: ReDoS in the parsing of authority part of URL

An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect.

CVSS 3.1 · 7.5 High EPSS 3.3% KEV · Not listed

Vendors

Fedoraproject Oracle Python and 1 more

Products

Fedora Enterprise Manager Ops Center Instantis Enterprisetrack and 7 more

CVE-2021-32028

postgresql: Memory disclosure in INSERT ... ON CONFLICT ... DO UPDATE

A flaw was found in postgresql. Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted table, an authenticated database user could read arbitrary bytes of server memory. The highest threat from this vulnerability is to data confidentiality.

CVSS 3.1 · 6.5 Medium EPSS 1.6% KEV · Not listed

Vendors

Postgresql Redhat

Products

Postgresql Ansible Automation Platform Enterprise Linux and 2 more

CVE-2021-32027

postgresql: Buffer overrun from integer overflow in array subscripting calculations

A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before 9.6.22. While modifying certain SQL array values, missing bounds checks let authenticated database users write arbitrary bytes to a wide area of server memory. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 3.1 · 8.8 High EPSS 2.0% KEV · Not listed

Vendors

Postgresql Redhat

Products

Postgresql Ansible Automation Platform Enterprise Linux and 4 more

CVE-2021-31535

libX11: missing request length checks

LookupCol.c in X.Org X through X11R7.7 and libX11 before 1.7.1 might allow remote attackers to execute arbitrary code. The libX11 XLookupColor request (intended for server-side color lookup) contains a flaw allowing a client to send color-name requests with a name longer than the maximum size allowed by the protocol (and also longer than the maximum packet size for normal-sized packets). The user-controlled data exceeding the maximum size is then interpreted by the server as additional X protocol requests and executed, e.g., to disable X server authorization completely. For example, if the victim encounters malicious terminal control sequences for color codes, then the attacker may be able to take full control of the running graphical session.

CVSS 3.1 · 9.8 Critical EPSS 10.4% KEV · Not listed

Vendors

Fedoraproject Redhat X.org

Products

Fedora Ansible Automation Platform Enterprise Linux and 2 more

CVE-2021-27291

python-pygments: ReDoS in multiple lexers

In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular expressions have exponential or cubic worst-case complexity and are vulnerable to ReDoS. By crafting malicious input, an attacker can cause a denial of service.

CVSS 3.1 · 7.5 High EPSS 3.9% KEV · Not listed

Vendors

Debian Fedoraproject Pygments and 1 more

Products

Debian Linux Fedora Pygments and 3 more

CVE-2021-23017

nginx: Off-by-one in ngx_resolver_copy() when labels are followed by a pointer to a root domain name

A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other impact.

CVSS 3.1 · 7.7 High EPSS 53.5% KEV · Not listed

Vendors

F5 Fedoraproject Netapp and 3 more

Products

Nginx Fedora Ontap Select Deploy Administration Utility and 16 more

CVE-2021-20270

python-pygments: Infinite loop in SML lexer may lead to DoS

An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML (SML) source file, as demonstrated by input that only contains the "exception" keyword.

CVSS 3.1 · 7.5 High EPSS 2.8% KEV · Not listed

Vendors

Debian Fedoraproject Pygments and 1 more

Products

Debian Linux Fedora Pygments and 6 more

CVE-2021-20253

ansible-tower: Privilege escalation via job isolation escape

A flaw was found in ansible-tower. The default installation is vulnerable to Job Isolation escape allowing an attacker to elevate the privilege from a low privileged user to the awx user from outside the isolated environment. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Ansible Automation Platform Ansible Tower

CVE-2021-20228

ansible: basic.py no_log with fallback option

A flaw was found in the Ansible Engine 2.9.18, where sensitive info is not masked by default and is not protected by the no_log feature when using the sub-option feature of the basic.py module. This flaw allows an attacker to obtain sensitive information. The highest threat from this vulnerability is to confidentiality.

CVSS 3.1 · 7.5 High EPSS 2.0% KEV · Not listed

Vendors

Debian Redhat

Products

Debian Linux Ansible Automation Platform Ansible Engine and 3 more

CVE-2021-20191

ansible: multiple modules expose secured values

A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest threat from this vulnerability is to data confidentiality. Versions before ansible 2.9.18 are affected.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Oracle Redhat

Products

Virtualization Ansible Ansible Automation Platform and 9 more

CVE-2021-20180

module: bitbucket_pipeline_variable exposes secured values

A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucket_pipeline_variable module. This flaw allows an attacker to steal bitbucket_pipeline credentials. The highest threat from this vulnerability is to confidentiality.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Ansible Ansible Automation Platform Ansible Engine and 2 more

CVE-2021-20178

ansible: user data leak in snmp_facts module

A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucket_pipeline_variable module. This flaw allows an attacker to steal bitbucket_pipeline credentials. The highest threat from this vulnerability is to confidentiality.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Redhat

Products

Fedora Ansible Ansible Automation Platform and 4 more