RedHat: RHSA-2021-1079:01 Moderate: Red Hat Ansible Automation Plat...

Advisories

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: Red Hat Ansible Automation Platform Operator 1.2 security update
Advisory ID:       RHSA-2021:1079-01
Product:           Red Hat Ansible Automation Platform
Advisory URL:      https://access.redhat.com/errata/RHSA-2021:1079
Issue date:        2021-04-06
Keywords:          Security Update
CVE Names:         CVE-2017-12652 CVE-2018-20843 CVE-2019-5094 
                   CVE-2019-5188 CVE-2019-11719 CVE-2019-11727 
                   CVE-2019-11756 CVE-2019-12749 CVE-2019-14866 
                   CVE-2019-14973 CVE-2019-15903 CVE-2019-17006 
                   CVE-2019-17023 CVE-2019-17498 CVE-2019-17546 
                   CVE-2019-19956 CVE-2019-20388 CVE-2019-20907 
                   CVE-2020-1971 CVE-2020-5313 CVE-2020-6829 
                   CVE-2020-7595 CVE-2020-8177 CVE-2020-8625 
                   CVE-2020-12243 CVE-2020-12400 CVE-2020-12401 
                   CVE-2020-12402 CVE-2020-12403 CVE-2020-14422 
                   CVE-2020-15999 CVE-2021-3156 CVE-2021-3447 
                   CVE-2021-20178 CVE-2021-20180 CVE-2021-20191 
                   CVE-2021-20228 
=====================================================================

1. Summary:

Red Hat Ansible Automation Platform Resource Operator 1.2 (technical
preview) images that fix several security issues.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Description:

Red Hat Ansible Automation Platform Resource Operator container images 
with security fixes.

Ansible Automation Platform manages Ansible Platform jobs and workflows
that can interface with any infrastructure on a Red Hat OpenShift Container
Platform cluster, or on a traditional infrastructure that is running
off-cluster.

Security fixes:

CVE-2021-20191 ansible: multiple modules expose secured values
[ansible_automation_platform-1.2] (BZ#1916813)

CVE-2021-20178 ansible: user data leak in snmp_facts module
[ansible_automation_platform-1.2] (BZ#1914774)

CVE-2021-20180 ansible: ansible module: bitbucket_pipeline_variable exposes
secured values [ansible_automation_platform-1.2] (BZ#1915808)

CVE-2021-20228 ansible: basic.py no_log with fallback option
[ansible_automation_platform-1.2] (BZ#1925002)

CVE-2021-3447 ansible: multiple modules expose secured values
[ansible_automation_platform-1.2] (BZ#1939349)

For more details about the security issue, including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

3. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

4. Bugs fixed (https://bugzilla.redhat.com/):

1914774 - CVE-2021-20178 ansible: user data leak in snmp_facts module
1915808 - CVE-2021-20180 ansible module: bitbucket_pipeline_variable exposes secured values
1916813 - CVE-2021-20191 ansible: multiple modules expose secured values
1925002 - CVE-2021-20228 ansible: basic.py no_log with fallback option
1939349 - CVE-2021-3447 ansible: multiple modules expose secured values

5. References:

https://access.redhat.com/security/cve/CVE-2017-12652
https://access.redhat.com/security/cve/CVE-2018-20843
https://access.redhat.com/security/cve/CVE-2019-5094
https://access.redhat.com/security/cve/CVE-2019-5188
https://access.redhat.com/security/cve/CVE-2019-11719
https://access.redhat.com/security/cve/CVE-2019-11727
https://access.redhat.com/security/cve/CVE-2019-11756
https://access.redhat.com/security/cve/CVE-2019-12749
https://access.redhat.com/security/cve/CVE-2019-14866
https://access.redhat.com/security/cve/CVE-2019-14973
https://access.redhat.com/security/cve/CVE-2019-15903
https://access.redhat.com/security/cve/CVE-2019-17006
https://access.redhat.com/security/cve/CVE-2019-17023
https://access.redhat.com/security/cve/CVE-2019-17498
https://access.redhat.com/security/cve/CVE-2019-17546
https://access.redhat.com/security/cve/CVE-2019-19956
https://access.redhat.com/security/cve/CVE-2019-20388
https://access.redhat.com/security/cve/CVE-2019-20907
https://access.redhat.com/security/cve/CVE-2020-1971
https://access.redhat.com/security/cve/CVE-2020-5313
https://access.redhat.com/security/cve/CVE-2020-6829
https://access.redhat.com/security/cve/CVE-2020-7595
https://access.redhat.com/security/cve/CVE-2020-8177
https://access.redhat.com/security/cve/CVE-2020-8625
https://access.redhat.com/security/cve/CVE-2020-12243
https://access.redhat.com/security/cve/CVE-2020-12400
https://access.redhat.com/security/cve/CVE-2020-12401
https://access.redhat.com/security/cve/CVE-2020-12402
https://access.redhat.com/security/cve/CVE-2020-12403
https://access.redhat.com/security/cve/CVE-2020-14422
https://access.redhat.com/security/cve/CVE-2020-15999
https://access.redhat.com/security/cve/CVE-2021-3156
https://access.redhat.com/security/cve/CVE-2021-3447
https://access.redhat.com/security/cve/CVE-2021-20178
https://access.redhat.com/security/cve/CVE-2021-20180
https://access.redhat.com/security/cve/CVE-2021-20191
https://access.redhat.com/security/cve/CVE-2021-20228
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/security/cve/CVE-2021-20191
https://access.redhat.com/security/cve/CVE-2021-20178
https://access.redhat.com/security/cve/CVE-2021-20180
https://access.redhat.com/security/cve/CVE-2021-20228
https://access.redhat.com/security/cve/CVE-2021-3447

6. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2021 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYHBeatzjgjWX9erEAQhLuw//QLV4QWc4E9o8cG3IJr3xIt6b/OHs6b9s
hp04e5kT7IWFpmR3VXK+BEK2dd+NiGdvXPOpwe4BaOUWEDmq+dx4Vac5Z0GcZJUK
AJz8dXFPYBgIafuIkWyY9UIvSO/VsQ2Dr4+KUnB1obALAz3ndSoQJFS1hysFBXHS
+MulKiYVwFw7UbfvGuFLjmLrNTAflVa9MHmdh3P53bU+U2mCgzuHTFIpodkZhuIt
aIR0H/dgHXXG8co20Zb5Nciqr0CxqejQ+xz84Yu0I+y1LWdBAhi34c3zJY4rlEQS
6/nfcsSPEadNCTXQu/TX6yvo6sE8A7/xGh1PDf0PLVv+Xh7TE53MtmTnYcl8uiRO
9m3CfJ7PLO2hpl6QuJzuUe7nXx65/qIoKQjZfNpZVXj/LQtL1F4RE7szmswIGNZL
IG51pYEUE98aR3gIlLpoMjW4vtC+rdcwSBaLW5gH1Q5hNRlTLmFBTKmYNkCpd4Ho
NP3AKEwx9R8ZdGYcCuZwYPvSQSqX+B9qURw5G4E/vbso8Vh9RYQ3kusnf93Q/1LG
ImHCbsVWJDMMt/NRj5OvqgZc18ROqHhSpuJ+A44VCI+UihkZb2ai4DjGef0WHZhq
XTMyLECTJIwM4aY+BC1ohYm0Whvs/w/hd03tGFBJhlIoBYakY6o8lRD7hCc8E/YI
dEQ0aSabgEY=
=D/Lt
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce

RedHat: RHSA-2021-1079:01 Moderate: Red Hat Ansible Automation Platform

Red Hat Ansible Automation Platform Resource Operator 1.2 (technical preview) images that fix several security issues

Summary

Red Hat Ansible Automation Platform Resource Operator container images with security fixes.
Ansible Automation Platform manages Ansible Platform jobs and workflows that can interface with any infrastructure on a Red Hat OpenShift Container Platform cluster, or on a traditional infrastructure that is running off-cluster.
Security fixes:
CVE-2021-20191 ansible: multiple modules expose secured values [ansible_automation_platform-1.2] (BZ#1916813)
CVE-2021-20178 ansible: user data leak in snmp_facts module [ansible_automation_platform-1.2] (BZ#1914774)
CVE-2021-20180 ansible: ansible module: bitbucket_pipeline_variable exposes secured values [ansible_automation_platform-1.2] (BZ#1915808)
CVE-2021-20228 ansible: basic.py no_log with fallback option [ansible_automation_platform-1.2] (BZ#1925002)
CVE-2021-3447 ansible: multiple modules expose secured values [ansible_automation_platform-1.2] (BZ#1939349)
For more details about the security issue, including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying this update, make sure all previously released erratarelevant to your system have been applied.For details on how to apply this update, refer to:https://access.redhat.com/articles/11258

References

https://access.redhat.com/security/cve/CVE-2017-12652 https://access.redhat.com/security/cve/CVE-2018-20843 https://access.redhat.com/security/cve/CVE-2019-5094 https://access.redhat.com/security/cve/CVE-2019-5188 https://access.redhat.com/security/cve/CVE-2019-11719 https://access.redhat.com/security/cve/CVE-2019-11727 https://access.redhat.com/security/cve/CVE-2019-11756 https://access.redhat.com/security/cve/CVE-2019-12749 https://access.redhat.com/security/cve/CVE-2019-14866 https://access.redhat.com/security/cve/CVE-2019-14973 https://access.redhat.com/security/cve/CVE-2019-15903 https://access.redhat.com/security/cve/CVE-2019-17006 https://access.redhat.com/security/cve/CVE-2019-17023 https://access.redhat.com/security/cve/CVE-2019-17498 https://access.redhat.com/security/cve/CVE-2019-17546 https://access.redhat.com/security/cve/CVE-2019-19956 https://access.redhat.com/security/cve/CVE-2019-20388 https://access.redhat.com/security/cve/CVE-2019-20907 https://access.redhat.com/security/cve/CVE-2020-1971 https://access.redhat.com/security/cve/CVE-2020-5313 https://access.redhat.com/security/cve/CVE-2020-6829 https://access.redhat.com/security/cve/CVE-2020-7595 https://access.redhat.com/security/cve/CVE-2020-8177 https://access.redhat.com/security/cve/CVE-2020-8625 https://access.redhat.com/security/cve/CVE-2020-12243 https://access.redhat.com/security/cve/CVE-2020-12400 https://access.redhat.com/security/cve/CVE-2020-12401 https://access.redhat.com/security/cve/CVE-2020-12402 https://access.redhat.com/security/cve/CVE-2020-12403 https://access.redhat.com/security/cve/CVE-2020-14422 https://access.redhat.com/security/cve/CVE-2020-15999 https://access.redhat.com/security/cve/CVE-2021-3156 https://access.redhat.com/security/cve/CVE-2021-3447 https://access.redhat.com/security/cve/CVE-2021-20178 https://access.redhat.com/security/cve/CVE-2021-20180 https://access.redhat.com/security/cve/CVE-2021-20191 https://access.redhat.com/security/cve/CVE-2021-20228 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/security/cve/CVE-2021-20191 https://access.redhat.com/security/cve/CVE-2021-20178 https://access.redhat.com/security/cve/CVE-2021-20180 https://access.redhat.com/security/cve/CVE-2021-20228 https://access.redhat.com/security/cve/CVE-2021-3447

Package List

Severity
Advisory ID: RHSA-2021:1079-01
Product: Red Hat Ansible Automation Platform
Advisory URL: https://access.redhat.com/errata/RHSA-2021:1079
Issued Date: : 2021-04-06
Keywords: Security Update
CVE Names: CVE-2017-12652 CVE-2018-20843 CVE-2019-5094 CVE-2019-5188 CVE-2019-11719 CVE-2019-11727 CVE-2019-11756 CVE-2019-12749 CVE-2019-14866 CVE-2019-14973 CVE-2019-15903 CVE-2019-17006 CVE-2019-17023 CVE-2019-17498 CVE-2019-17546 CVE-2019-19956 CVE-2019-20388 CVE-2019-20907 CVE-2020-1971 CVE-2020-5313 CVE-2020-6829 CVE-2020-7595 CVE-2020-8177 CVE-2020-8625 CVE-2020-12243 CVE-2020-12400 CVE-2020-12401 CVE-2020-12402 CVE-2020-12403 CVE-2020-14422 CVE-2020-15999 CVE-2021-3156 CVE-2021-3447 CVE-2021-20178 CVE-2021-20180 CVE-2021-20191 CVE-2021-20228

Topic

Red Hat Ansible Automation Platform Resource Operator 1.2 (technicalpreview) images that fix several security issues.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Relevant Releases Architectures

Bugs Fixed

1914774 - CVE-2021-20178 ansible: user data leak in snmp_facts module

1915808 - CVE-2021-20180 ansible module: bitbucket_pipeline_variable exposes secured values

1916813 - CVE-2021-20191 ansible: multiple modules expose secured values

1925002 - CVE-2021-20228 ansible: basic.py no_log with fallback option

1939349 - CVE-2021-3447 ansible: multiple modules expose secured values

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.