CVE-2021-31918
published 2021-05-06CVE-2021-31918: A flaw was found in tripleo-ansible version as shipped in Red Hat Openstack 16.1. The Ansible log file is readable to all users during stack update and…
PriorityP340high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
1.00%
58.6th percentile
A flaw was found in tripleo-ansible version as shipped in Red Hat Openstack 16.1. The Ansible log file is readable to all users during stack update and creation. The highest threat from this vulnerability is to data confidentiality.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | openstack | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-r7f5-2xmq-3252: A flaw was found in tripleo-ansible version as shipped in Red Hat Openstack 16
ghsa_unreviewed·2022-05-24
CVE-2021-31918 [HIGH] CWE-200 GHSA-r7f5-2xmq-3252: A flaw was found in tripleo-ansible version as shipped in Red Hat Openstack 16
A flaw was found in tripleo-ansible version as shipped in Red Hat Openstack 16.1. The Ansible log file is readable to all users during stack update and creation. The highest threat from this vulnerability is to data confidentiality.
Red Hat
tripleo-ansible: ansible.log file is visible to unprivileged users
vendor_redhat·2021-04-29·CVSS 7.5
CVE-2021-31918 [HIGH] CWE-200 tripleo-ansible: ansible.log file is visible to unprivileged users
tripleo-ansible: ansible.log file is visible to unprivileged users
A flaw was found in tripleo-ansible version as shipped in Red Hat Openstack 16.1. The Ansible log file is readable to all users during stack update and creation. The highest threat from this vulnerability is to data confidentiality.
A flaw was found in tripleo-ansible. The Ansible log file is readable to all users during stack update and creation. The highest threat from this vulnerability is to data confidentiality.
Mitigation: This vulnerability can be resolved by manually adjusting the file permissions. Run the following command: chmod o-r /var/lib/mistral/overcloud/ansible.log
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-05-06
Published