Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-3420 State: PUBLISHED Published: 2021-03-05T19:19:28 Last Updated: 2024-08-03T16:53:17.747Z Vendors: n/a Products: newlib Problem Types: CWE-190 Description: A flaw was found in newlib in versions prior to 4.0.0. Improper overflow validation in the memory allocation functions mEMALIGn, pvALLOc, nano_memalign, nano_valloc, nano_pvalloc could case an integer overflow, leading to an allocation of a small buffer and then to a heap-based buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1934088 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEBF6YHWFNCBW
1934088 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEBF6YHWFNCBW5A2ENSQ3Z56ELF4MTRE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LSQZEUANAWBBAOC4TF5PTPJVLMUR7SFD/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AMK54N6UOPBFFX2YT32TWSAEFTHGSKAA/
CVE ID: CVE-2021-3421 State: PUBLISHED Published: 2021-05-19T13:40:58 Last Updated: 2024-08-03T16:53:17.462Z Vendors: n/a Products: rpm Problem Types: CWE-347 Description: A flaw was found in the RPM package in the read functionality. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package or compromise an RPM repository, to cause RPM database corruption. The highest threat from this vulnerability is to data integrity. This flaw affects RPM versions before 4.17.0-alpha. Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHRPNBCRPDJHHQE3MBPSZK
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHRPNBCRPDJHHQE3MBPSZK4H7X2IM7AC/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TMGXO3W6DHPO62GJ4VVF5DEUX5DRUR5K/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YILPBTPSBRYL4POBI3F4YUSVPSOQNJBY/ - https://bugzilla.redhat.com/show_bug.cgi?id=1927747 - https://security.gentoo.org/glsa/202107-43
CVE ID: CVE-2021-3422 State: PUBLISHED Published: 2022-03-25T18:02:43 Last Updated: 2024-08-03T16:53:17.577Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Splunk Products: Splunk Enterprise Problem Types: CWE-125 Description: The lack of validation of a key-value field in the Splunk-to-Splunk protocol results in a denial-of-service in Splunk Enterprise instances configured to index Universal Forwarder traffic. The vulnerability impacts Splunk Enterprise versions before 7.3.9, 8.0 versions before 8.0.9, and 8.1 versions before 8.1.3. It does not impact Universal Forwarders. When Splunk forwarding is secured using TLS or a Token, the attack requires compromisi
not impact Universal Forwarders. When Splunk forwarding is secured using TLS or a Token, the attack requires compromising the certificate or token, or both. Implementation of either or both reduces the severity to Medium. Additional Analyst Notes: - CVE Program Container: References: - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0301.html - https://claroty.com/2022/03/24/blog-research-locking-down-splunk-enterprise-indexers-and-forwarders/
CVE ID: CVE-2021-3423 State: PUBLISHED Published: 2021-05-18T11:00:17.184714Z Last Updated: 2024-09-17T00:41:26.663Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: BItdefender Products: GravityZone Business Security Problem Types: CWE-427 Description: Uncontrolled Search Path Element vulnerability in the openssl component as used in Bitdefender GravityZone Business Security allows an attacker to load a third party DLL to elevate privileges. This issue affects Bitdefender GravityZone Business Security versions prior to 6.6.23.329. Additional Analyst Notes: - CVE Program Container: References: - https://www.bitdefender.com/support/security-advisories/privilege-
Analyst Notes: - CVE Program Container: References: - https://www.bitdefender.com/support/security-advisories/privilege-escalation-in-bitdefender-gravityzone-business-security-va-9557
CVE ID: CVE-2021-3424 State: PUBLISHED Published: 2021-06-01T18:43:33 Last Updated: 2024-08-03T16:53:17.503Z Vendors: n/a Products: keycloak Problem Types: CWE-287 Description: A flaw was found in keycloak as shipped in Red Hat Single Sign-On 7.4 where IDN homograph attacks are possible. A malicious user can register himself with a name already registered and trick admin to grant him extra privileges. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1933320
CVE ID: CVE-2021-3425 State: PUBLISHED Published: 2021-06-01T19:07:40 Last Updated: 2024-08-03T16:53:17.522Z Vendors: n/a Products: broker Problem Types: CWE-532 Description: A flaw was found in the AMQ Broker that discloses JDBC encrypted usernames and passwords when provided in the AMQ Broker application logfile when using the jdbc persistence functionality. Versions shipped in Red Hat AMQ 7 are vulnerable. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1936629
CVE ID: CVE-2021-3426 State: PUBLISHED Published: 2021-05-20T00:00:00.000Z Last Updated: 2025-11-03T21:44:51.975Z Vendors: n/a Products: python Problem Types: CWE-200 Description: There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or adjacent user to start a pydoc server could access the server and use it to disclose sensitive information belonging to the other user that they would not normally be able to access. The highest risk of this flaw is to data confidentiality. This flaw affects Python versions before 3.8.9, Python versions before 3.9.3 and Python versions before 3.10.0a7. Additional Analyst Notes: - CVE Program Contai
3.8.9, Python versions before 3.9.3 and Python versions before 3.10.0a7. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/25HVHLBGO2KNPXJ3G426QEYSSCECJDU5/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VPX7Y5GQDNB4FJTREWONGC4ZSVH7TGHF/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DQYPUKLLBOZMKFPO7RD7CENTXHUUEUV7/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/mess
OZMKFPO7RD7CENTXHUUEUV7/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QNGAFMPIYIVJ47FCF2NK2PIX22HUG35B/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BF2K7HEWADHN6P52R3QLIOX27U3DJ4HI/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LM5V4VPLBHBEASSAROYPSHXGXGGPHNOE/ - https://security.gentoo.org/glsa/202104-04 - https://bugzilla.redhat.com/show_bug.cgi?id=1935913 - https://www.oracle.com/security-alerts/cpu
oo.org/glsa/202104-04 - https://bugzilla.redhat.com/show_bug.cgi?id=1935913 - https://www.oracle.com/security-alerts/cpuoct2021.html - https://security.netapp.com/advisory/ntap-20210629-0003/ - https://www.oracle.com/security-alerts/cpujan2022.html - https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html
CVE ID: CVE-2021-3427 State: PUBLISHED Published: 2022-08-26T00:00:00 Last Updated: 2024-08-03T16:53:17.608Z Vendors: n/a Products: Deluge-web Problem Types: CWE-79 Description: The Deluge Web-UI is vulnerable to XSS through a crafted torrent file. The the data from torrent files is not properly sanitised as it's interpreted directly as HTML. Someone who supplies the user with a malicious torrent file can execute arbitrary Javascript code in the context of the user's browser session. Additional Analyst Notes: - CVE Program Container: References: - https://dev.deluge-torrent.org/ticket/3459 - https://groups.google.com/g/deluge-dev/c/e5zh7wT0rEg - https://security.gentoo.org/glsa/202210-07
CVE ID: CVE-2021-3428 State: PUBLISHED Published: 2022-03-04T17:19:22 Last Updated: 2024-08-03T16:53:17.577Z Vendors: n/a Products: kernel Problem Types: CWE-190 Description: A flaw was found in the Linux kernel. A denial of service problem is identified if an extent tree is corrupted in a crafted ext4 filesystem in fs/ext4/extents.c in ext4_es_cache_extent. Fabricating an integer overflow, A local attacker with a special user privilege may cause a system crash problem which can lead to an availability threat. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1972621 - https://ubuntu.com/security/CVE-2021-3428 - https://www.openwall.
https://bugzilla.redhat.com/show_bug.cgi?id=1972621 - https://ubuntu.com/security/CVE-2021-3428 - https://www.openwall.com/lists/oss-security/2021/03/17/1
CVE ID: CVE-2021-3429 State: PUBLISHED Published: 2023-04-19T21:42:02.402Z Last Updated: 2025-02-05T14:44:18.828Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Canonical Ltd. Products: cloud-init Problem Types: CWE-532 Description: When instructing cloud-init to set a random password for a new user account, versions before 21.2 would write that password to the world-readable log file /var/log/cloud-init-output.log. This could allow a local user to log in as another user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/canonical/cloud-init/commit/b794d426b9ab43ea9d6371477466070d86e10668
CVE ID: CVE-2021-3430 State: PUBLISHED Published: 2022-06-28T19:45:19.535562Z Last Updated: 2024-09-16T23:25:47.802Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: zephyrproject-rtos Products: zephyr Problem Types: CWE-617 Description: Assertion reachable with repeated LL_CONNECTION_PARAM_REQ. Zephyr versions >= v1.14 contain Reachable Assertion (CWE-617). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-46h3-hjcq-2jjr Additional Analyst Notes: - CVE Program Container: References: - http://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-46h3-hjcq-2jjr
CVE ID: CVE-2021-3431 State: PUBLISHED Published: 2022-06-28T19:45:23.532259Z Last Updated: 2024-09-16T22:52:14.507Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: zephyrproject-rtos Products: zephyr Problem Types: CWE-617 Description: Assertion reachable with repeated LL_FEATURE_REQ. Zephyr versions >= v2.5.0 contain Reachable Assertion (CWE-617). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-7548-5m6f-mqv9 Additional Analyst Notes: - CVE Program Container: References: - http://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-7548-5m6f-mqv9
CVE ID: CVE-2021-3432 State: PUBLISHED Published: 2022-06-28T19:45:28.514936Z Last Updated: 2024-09-17T00:21:58.869Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: zephyrproject-rtos Products: zephyr Problem Types: CWE-369 Description: Invalid interval in CONNECT_IND leads to Division by Zero. Zephyr versions >= v1.14.0 Divide By Zero (CWE-369). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-7364-p4wc-8mj4 Additional Analyst Notes: - CVE Program Container: References: - http://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-7364-p4wc-8mj4
CVE ID: CVE-2021-3433 State: PUBLISHED Published: 2022-06-28T19:45:34.282461Z Last Updated: 2024-09-16T18:28:43.255Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: zephyrproject-rtos Products: zephyr Problem Types: CWE-703 Description: Invalid channel map in CONNECT_IND results to Deadlock. Zephyr versions >= v2.5.0 Improper Check or Handling of Exceptional Conditions (CWE-703). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-3c2f-w4v6-qxrp Additional Analyst Notes: - CVE Program Container: References: - http://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-3c2f-w4v6-qxrp
CVE ID: CVE-2021-3434 State: PUBLISHED Published: 2022-06-28T19:45:39.519233Z Last Updated: 2024-09-17T00:36:23.340Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: zephyrproject-rtos Products: zephyr Problem Types: CWE-121 Description: Stack based buffer overflow in le_ecred_conn_req(). Zephyr versions >= v2.5.0 Stack-based Buffer Overflow (CWE-121). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-8w87-6rfp-cfrm Additional Analyst Notes: - CVE Program Container: References: - http://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-8w87-6rfp-cfrm
CVE ID: CVE-2021-3435 State: PUBLISHED Published: 2022-06-28T19:45:44.593076Z Last Updated: 2024-09-16T17:48:21.384Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: zephyrproject-rtos Products: zephyr Problem Types: CWE-908 Description: Information leakage in le_ecred_conn_req(). Zephyr versions >= v2.4.0 Use of Uninitialized Resource (CWE-908). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-xhg3-gvj6-4rqh Additional Analyst Notes: - CVE Program Container: References: - http://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-xhg3-gvj6-4rqh
CVE ID: CVE-2021-3436 State: PUBLISHED Published: 2021-10-05T20:50:15.802366Z Last Updated: 2024-09-16T20:31:46.210Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: zephyrproject-rtos Products: zephyr Problem Types: CWE-694 Description: BT: Possible to overwrite an existing bond during keys distribution phase when the identity address of the bond is known. Zephyr versions >= 1.14.2, >= 2.4.0, >= 2.5.0 contain Use of Multiple Resources with Duplicate Identifier (CWE-694). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-j76f-35mc-4h63 Additional Analyst Notes: - CVE Program Container: References: - http://github.
/security/advisories/GHSA-j76f-35mc-4h63 Additional Analyst Notes: - CVE Program Container: References: - http://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-j76f-35mc-4h63
CVE ID: CVE-2021-3437 State: PUBLISHED Published: 2022-11-21T21:15:05.040Z Last Updated: 2025-04-29T04:46:07.800Z Vendors: HP Inc. Products: OMEN Gaming Hub SDK Problem Types: n/a Description: Potential security vulnerabilities have been identified in an OMEN Gaming Hub SDK package which may allow escalation of privilege and/or denial of service. HP is releasing software updates to mitigate the potential vulnerabilities. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hp.com/us-en/document/ish_4610088-4610112-16/hpsbgn03726
CVE ID: CVE-2021-3438 State: PUBLISHED Published: 2021-05-20T13:32:49 Last Updated: 2024-08-03T16:53:17.609Z Vendors: n/a Products: Certain HP LaserJet products and Samsung product printers, see Security Bulletin Problem Types: Escalation of privilege. Description: A potential buffer overflow in the software drivers for certain HP LaserJet products and Samsung product printers could lead to an escalation of privilege. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/ish_3900395-3833905-16
CVE ID: CVE-2021-3439 State: PUBLISHED Published: 2023-01-30T21:39:58.692Z Last Updated: 2025-03-27T18:53:50.932Z Vendors: HP Inc. Products: HP PC BIOS Problem Types: n/a Description: HP has identified a potential vulnerability in BIOS firmware of some Workstation products. Firmware updates are being released to mitigate these potential vulnerabilities. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hp.com/us-en/document/ish_3982318-3982351-16/hpsbhf03735
CVE ID: CVE-2021-3440 State: PUBLISHED Published: 2021-11-01T13:14:47 Last Updated: 2024-08-03T16:53:17.582Z Vendors: n/a Products: HP Print and Scan Doctor, an application within the HP Smart App for Windows Problem Types: local elevation of privilege Description: HP Print and Scan Doctor, an application within the HP Smart App for Windows, is potentially vulnerable to local elevation of privilege. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/ish_4120228-4120263-16/hpsbpi03727
CVE ID: CVE-2021-3441 State: PUBLISHED Published: 2021-10-29T11:34:41 Last Updated: 2024-08-03T16:53:17.623Z Vendors: n/a Products: HP OfficeJet 7110 Wide Format ePrinter Problem Types: Cross-Site Scripting (XSS) Description: A potential security vulnerability has been identified for the HP OfficeJet 7110 Wide Format ePrinter that enables Cross-Site Scripting (XSS). Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/ish_4433829-4433857-16/hpsbpi03742
CVE ID: CVE-2021-3442 State: PUBLISHED Published: 2022-08-22T14:44:00 Last Updated: 2024-08-03T16:53:17.603Z Vendors: n/a Products: Red Hat OpenShift API Management. Problem Types: CWE-20 Description: A flaw was found in the Red Hat OpenShift API Management product. User input is not validated allowing an authenticated user to inject scripts into some text boxes leading to a XSS attack. The highest threat from this vulnerability is to data confidentiality. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1930083 - https://access.redhat.com/security/cve/CVE-2021-3442
CVE ID: CVE-2021-3443 State: PUBLISHED Published: 2021-03-25T18:45:18 Last Updated: 2024-08-03T16:53:17.623Z Vendors: n/a Products: jasper Problem Types: CWE-476 Description: A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.27 handled component references in the JP2 image format decoder. A specially crafted JP2 image file could cause an application using the Jasper library to crash when opened. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1939233
CVE ID: CVE-2021-3444 State: PUBLISHED Published: 2021-03-23T17:45:13.714724Z Last Updated: 2024-09-16T17:27:58.788Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Linux Products: kernel Problem Types: CWE-681 Description: The bpf verifier in the Linux kernel did not properly handle mod32 destination register truncation when the source register was known to be 0. A local attacker with the ability to load bpf programs could use this gain out-of-bounds reads in kernel memory leading to information disclosure (kernel memory), and possibly out-of-bounds writes that could potentially lead to code execution. This issue was addressed in the upstream kernel in commit
f-bounds writes that could potentially lead to code execution. This issue was addressed in the upstream kernel in commit 9b00f1b78809 ("bpf: Fix truncation handling for mod32 dst reg wrt zero") and in Linux stable kernels 5.11.2, 5.10.19, and 5.4.101. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9b00f1b78809 - https://www.openwall.com/lists/oss-security/2021/03/23/2 - http://www.openwall.com/lists/oss-security/2021/03/23/2 - http://packetstormsecurity.com/files/162117/Kernel-Live-Patch-Security-Notice-LSN-0075-1.html - https://security.netapp.com/advisory/ntap-20210416-0006/ - https://lists.debi
ve-Patch-Security-Notice-LSN-0075-1.html - https://security.netapp.com/advisory/ntap-20210416-0006/ - https://lists.debian.org/debian-lts-announce/2021/10/msg00010.html - http://packetstormsecurity.com/files/164950/Kernel-Live-Patch-Security-Notice-LSN-0082-1.html
CVE ID: CVE-2021-3445 State: PUBLISHED Published: 2021-05-19T13:44:23 Last Updated: 2024-08-03T16:53:17.619Z Vendors: n/a Products: libdnf Problem Types: CWE-347 Description: A flaw was found in libdnf's signature verification functionality in versions before 0.60.1. This flaw allows an attacker to achieve code execution if they can alter the header information of an RPM package and then trick a user or system into installing it. The highest risk of this vulnerability is to confidentiality, integrity, as well as system availability. Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message
ontainer: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G4NL7TNWAHJ6JVRABQUPWHKKCTHUZMNF/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DPMFGGQ5T6WVFTFX3OKMVTTM5O4EXWZR/ - https://bugzilla.redhat.com/show_bug.cgi?id=1932079
CVE ID: CVE-2021-3446 State: PUBLISHED Published: 2021-03-25T18:45:25 Last Updated: 2024-08-03T16:53:17.575Z Vendors: n/a Products: libtpms Problem Types: CWE-327 Description: A flaw was found in libtpms in versions before 0.8.2. The commonly used integration of libtpms with OpenSSL contained a vulnerability related to the returned IV (initialization vector) when certain symmetric ciphers were used. Instead of returning the last IV it returned the initial IV to the caller, thus weakening the subsequent encryption and decryption steps. The highest threat from this vulnerability is to data confidentiality. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat
ity is to data confidentiality. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1939664
CVE ID: CVE-2021-3447 State: PUBLISHED Published: 2021-04-01T00:00:00 Last Updated: 2024-08-03T16:53:17.543Z Vendors: n/a Products: ansible Problem Types: CWE-532 Description: A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged in plain-text on managed nodes, as well as being made visible on the controller node when run in verbose mode. These parameters were not protected by the no_log feature. An attacker can take advantage of this information to steal those credentials, provided when they have access to the log files containing them. The highest threat from this vulnerability is to data confidentiality. This flaw affects
the log files containing them. The highest threat from this vulnerability is to data confidentiality. This flaw affects Red Hat Ansible Automation Platform in versions before 1.2.2 and Ansible Tower in versions before 3.8.2. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1939349 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JBZ75MAMVQVZROPYHMRDQKPPVASP63DG/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RUTGO4RS4ZXZSPBU2CHVPT75IAFVTTL3/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/m
RS4ZXZSPBU2CHVPT75IAFVTTL3/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MS4VPUYVLGSAKOX26IT52BSMEZRZ3KS/ - https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html