ansible_automation_platform Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/ansible_automation_platform/ Thu, 23 Feb 2023 14:10:45 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png ansible_automation_platform Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/ansible_automation_platform/ 32 32 CVE-2021-3681 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-3681/ Thu, 23 Feb 2023 14:10:45 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-3681/ A flaw was found in Ansible Galaxy Collections. When collections are built manually, any files in the repository directory that are not explicitly excluded via the “build_ignore“ list in “galaxy.yml” include files in the “.tar.gz“ file. This contains sensitive info, such as the user’s Ansible Galaxy API key and any secrets in “ansible“ or “ansible-playbook“ […]

The post CVE-2021-3681 appeared first on CVE Vulnerability.

]]> A flaw was found in Ansible Galaxy Collections. When collections are built manually, any files in the repository directory that are not explicitly excluded via the “build_ignore“ list in “galaxy.yml” include files in the “.tar.gz“ file. This contains sensitive info, such as the user’s Ansible Galaxy API key and any secrets in “ansible“ or “ansible-playbook“ verbose output without the“no_log“ redaction. Currently, there is no way to deprecate a Collection Or delete a Collection Version. Once published, anyone who downloads or installs the collection can view the secrets.

The post CVE-2021-3681 appeared first on CVE Vulnerability.

]]> CVE-2022-3644 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-3644/ Thu, 23 Feb 2023 05:19:51 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-3644/ The collection remote for pulp_ansible stores tokens in plaintext instead of using pulp’s encrypted field and exposes them in read/write mode via the API () instead of marking it as write only.

The post CVE-2022-3644 appeared first on CVE Vulnerability.

]]> The collection remote for pulp_ansible stores tokens in plaintext instead of using pulp’s encrypted field and exposes them in read/write mode via the API () instead of marking it as write only.

The post CVE-2022-3644 appeared first on CVE Vulnerability.

]]> CVE-2022-3205 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-3205/ Thu, 23 Feb 2023 05:18:59 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-3205/ Cross site scripting in automation controller UI in Red Hat Ansible Automation Platform 1.2 and 2.0 where the project name is susceptible to XSS injection

The post CVE-2022-3205 appeared first on CVE Vulnerability.

]]> Cross site scripting in automation controller UI in Red Hat Ansible Automation Platform 1.2 and 2.0 where the project name is susceptible to XSS injection

The post CVE-2022-3205 appeared first on CVE Vulnerability.

]]> CVE-2022-2568 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-2568/ Thu, 23 Feb 2023 05:17:41 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-2568/ A privilege escalation flaw was found in the Ansible Automation Platform. This flaw allows a remote authenticated user with ‘change user’ permissions to modify the account settings of the superuser account and also remove the superuser privileges.

The post CVE-2022-2568 appeared first on CVE Vulnerability.

]]> A privilege escalation flaw was found in the Ansible Automation Platform. This flaw allows a remote authenticated user with ‘change user’ permissions to modify the account settings of the superuser account and also remove the superuser privileges.

The post CVE-2022-2568 appeared first on CVE Vulnerability.

]]> CVE-2022-1632 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-1632/ Thu, 23 Feb 2023 05:02:08 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-1632/ An Improper Certificate Validation attack was found in Openshift. A re-encrypt Route with destinationCACertificate explicitly set to the default serviceCA skips internal Service TLS certificate validation. This flaw allows an attacker to exploit an invalid certificate, resulting in a loss of confidentiality.

The post CVE-2022-1632 appeared first on CVE Vulnerability.

]]> An Improper Certificate Validation attack was found in Openshift. A re-encrypt Route with destinationCACertificate explicitly set to the default serviceCA skips internal Service TLS certificate validation. This flaw allows an attacker to exploit an invalid certificate, resulting in a loss of confidentiality.

The post CVE-2022-1632 appeared first on CVE Vulnerability.

]]>