Security Bulletin: Vulnerability in Ansible bundled with IBM Spectrum Fusion HCI

Summary

IBM Spectrum Fusion includes Ansible which could allow a local authenticated attacker to obtain sensitive information (CVE-2021-20180)

Vulnerability Details

CVEID:CVE-2021-20180
**DESCRIPTION:**Ansible could allow a local authenticated attacker to obtain sensitive information, caused by disclosure of information in the console log when using the bitbucket_pipeline_variable. An attacker could exploit this vulnerability to steal bitbucket_pipeline credentials.
CVSS Base score: 5.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/222527 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

CVEID:CVE-2021-3589
**DESCRIPTION:**Foreman Ansible could allow a remote authenticated attacker to bypass security restrictions, caused by an authorization flaw. By sending a specially-crafted request, an attacker could exploit this vulnerability to access hosts through job templates.
CVSS Base score: 6
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/222525 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L)

Affected Products and Versions

Remediation/Fixes

IBM Spectrum Fusion’s version of Ansible has been updated to remediate this vulnerability:

Workarounds and Mitigations

None