Bug 1930352 (CVE-2021-3413)

Summary:	CVE-2021-3413 Satellite: Azure compute resource secret_key leak to authenticated users
Product:	[Other] Security Response	Reporter:	Yadnyawalk Tale <ytale>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	bbuckingham, bcourt, bkearney, btotty, hhudgeon, lzap, mmccune, nmoumoul, pcreech, rchan, rjerrido, sokeeffe
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	tfm-rubygem-foreman_azure_rm 2.2.0	Doc Type:	---
Doc Text:	A flaw was found in Red Hat Satellite. A credential leak was identified which will expose Azure Resource Manager's secret key through JSON of the API output. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-11-11 05:58:22 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1928786, 1930367
Bug Blocks:	1929261, 1930362

Description Yadnyawalk Tale 2021-02-18 17:44:16 UTC

A credential leak vulnerability was found in Red Hat Satellite through Azure Resource Manager. This flaw exposes the compute resources credentials with in the Satellite.

Comment 1 Yadnyawalk Tale 2021-02-18 17:44:22 UTC

Acknowledgments:

Name: Evgeni Golov (Red Hat)

Comment 2 Yadnyawalk Tale 2021-02-18 17:44:26 UTC

Statement:

Red Hat Satellite is vulnerable to the compute resource credential leak. Red Hat Product Security has rated this flaw as having a security impact of Moderate. Please refer to https://access.redhat.com/security/updates/classification for clarification on the scoring.

Comment 5 errata-xmlrpc 2021-11-16 14:07:55 UTC

This issue has been addressed in the following products:

  Red Hat Satellite 6.10 for RHEL 7

Via RHSA-2021:4702 https://access.redhat.com/errata/RHSA-2021:4702