snmp_facts module in Ansible leaks user authentication such as authKey and privKey. This could lead in disclosing those credentials for every user which has access to the output of playbook execution.
Acknowledgments: Name: Abhijeet Kasurde (Red Hat)
Hi Is there a upstream issue reference for this issue? Regards, Salvatore
Hi, Please refer the below for upstream reference for this issue. https://github.com/ansible-collections/community.general/pull/1621 Kind Regards, Tapas J
Hi Tapas, Thank you. Regards, Salvatore
Created ansible tracking bugs for this issue: Affects: fedora-all [bug 1917287]
Created ansible tracking bugs for this issue: Affects: epel-all [bug 1917330]
Created ansible tracking bugs for this issue: Affects: openstack-rdo [bug 1917331]
This issue has been addressed in the following products: Red Hat Ansible Engine 2 for RHEL 8 Red Hat Ansible Engine 2 for RHEL 7 Via RHSA-2021:0663 https://access.redhat.com/errata/RHSA-2021:0663
This issue has been addressed in the following products: Red Hat Ansible Engine 2.9 for RHEL 8 Red Hat Ansible Engine 2.9 for RHEL 7 Via RHSA-2021:0664 https://access.redhat.com/errata/RHSA-2021:0664
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2021-20178
Statement: The version of ansible shipped with Red Hat Gluster Storage (RHGS) 3 includes the vulnerable snmp module. However, RHGS 3 no longer maintains its own version of Ansible, prerequisite is to enable ansible repository in order to consume the latest version of ansible which has many bug and security fixes.
This issue has been addressed in the following products: Red Hat Ansible Automation Platform 1.2 for RHEL 7 Via RHSA-2021:1079 https://access.redhat.com/errata/RHSA-2021:1079
Please note the filing of CVE-2020-20178 links to this BZ (https://bugzilla.redhat.com/show_bug.cgi?id=1914774), (see: https://nvd.nist.gov/vuln/detail/CVE-2020-20178) However there is no mention of OpenLDAP issue being affected in this BZ despite the CVE filing noting the OpenLDAP issue "A flaw was found in OpenLDAP. This flaw allows an attacker who can send a malicious packet to be processed by OpenLDAP’s slapd server, to trigger an assertion failure. The highest threat from this vulnerability is to system availability." Instead should the CVE filing note this BZ link: https://bugzilla.redhat.com/show_bug.cgi?id=1928774 and https://bugzilla.redhat.com/show_bug.cgi?id=1899675 instead of https://bugzilla.redhat.com/show_bug.cgi?id=1914774 ?
This issue has been addressed in the following products: Red Hat Virtualization 4 for Red Hat Enterprise Linux 8 Red Hat Virtualization Engine 4.4 Red Hat Virtualization 4 Tools for Red Hat Enterprise Linux 8 Via RHSA-2021:2180 https://access.redhat.com/errata/RHSA-2021:2180