CVE-2021-3681

Katalog CVE

CVSS 5.5 · Medium EPSS 0,25%

Kerentanan Insufficiently Protected Credentials pada redhat ansible automation platform, redhat ansible galaxy. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

A flaw was found in Ansible Galaxy Collections. When collections are built manually, any files in the repository directory that are not explicitly excluded via the ``build_ignore`` list in "galaxy.yml" include files in the ``.tar.gz`` file. This contains sensitive info, such as the user's Ansible Galaxy API key and any secrets in ``ansible`` or ``ansible-playbook`` verbose output without the``no_log`` redaction. Currently, there is no way to deprecate a Collection Or delete a Collection Version. Once published, anyone who downloads or installs the collection can view the secrets.

Rincian

Terbit di NVD

18 April 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-522: Insufficiently Protected Credentials

EPSS (30 hari)

0,25% peluang dieksploitasi; lebih tinggi dari 14,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugzilla.redhat.com/show_bug.cgi?id=1989407 issue tracking · advisory vendor
• https://github.com/ansible/galaxy/issues/1977 advisory pihak ketiga