CVE-2021-31918 Information disclosure in tripleo-ansible
Local users can read Ansible log files during stack operations, potentially exposing sensitive configuration data in OpenStack deployments.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-31918?
CVE-2021-31918 is a high-severity vulnerability in Redhat Openstack, published on 6 May 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in tripleo-ansible version as shipped in Red Hat Openstack 16.1. The Ansible log file is readable to all users during stack update and creation. The highest threat from this vulnerability is to data confidentiality.
Which versions are affected by CVE-2021-31918?
It affects 1 product.
Linux distribution packages (1)
tripleo-ansible Red Hat:openstack:16.1::el8 | All versions | 0:0.5.1-1.20210323173506.el8ost |
Products include Redhat Openstack.
How do I fix CVE-2021-31918?
Apply the vendor's patch.
Is CVE-2021-31918 being exploited?
There is no known exploitation of CVE-2021-31918 in the wild and no public exploit code.
Other vulnerabilities in Redhat Openstack
Sources
Also known as GHSA-r7f5-2xmq-3252, RHSA-2021:2119.