Red Hat Ansible Galaxy 3.3.0

CPE Details

Red Hat Ansible Galaxy 3.3.0
redhat
ansible_galaxy
3.3.0
2022-04-26
10h34 +00:00
2022-06-06
11h54 +00:00
CPE NVD
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
Notifications manage

CPE Name: cpe:2.3:a:redhat:ansible_galaxy:3.3.0:*:*:*:*:*:*:*

Informations

Vendor

redhat

Product

ansible_galaxy

Version

3.3.0

Related CVE

Open and find in CVE List

CVE ID Published Description Score Severity
CVE-2021-3681 2022-04-18 14h20 +00:00 A flaw was found in Ansible Galaxy Collections. When collections are built manually, any files in the repository directory that are not explicitly excluded via the ``build_ignore`` list in "galaxy.yml" include files in the ``.tar.gz`` file. This contains sensitive info, such as the user's Ansible Galaxy API key and any secrets in ``ansible`` or ``ansible-playbook`` verbose output without the``no_log`` redaction. Currently, there is no way to deprecate a Collection Or delete a Collection Version. Once published, anyone who downloads or installs the collection can view the secrets.
5.5
Medium
The information presented on CVE Find originates from several carefully selected reference sources. CVE data is provided by MITRE Corporation and the National Vulnerability Database (NVD). The Known Exploited Vulnerabilities (KEV) catalog is sourced from the Cybersecurity and Infrastructure Security Agency (CISA), while EPSS scores come from FIRST.org. Additionally, data regarding software weaknesses (CWE) and common attack patterns (CAPEC) is maintained by MITRE Corporation, and information on hardware and software configurations (CPE) is provided by the NVD.