CVE-2021-3413: Infoleak
A credential leak vulnerability was found in Red Hat Satellite through Azure Resource Manager. This flaw exposes the compute resources credentials with in the Satellite.
Other sources
A flaw was found in Red Hat Satellite in tfm-rubygem-foremanazurerm in versions before 2.2.0. A credential leak was identified which will expose Azure Resource Manager's secret key through JSON of the API output. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/tfm-rubygem-foreman_azure_rmto a version that resolves this vulnerability.Fixed in 2.2.0 - Upgrade
Upgrade
Red Hat Satellite - tfm-rubygem-foreman_azure_rmto a version that resolves this vulnerability.Fixed in 2.2.0 - Compensating control
Limit exposure by reducing access to Azure Resource Manager API output that contains the exposed secret key (e.g., restrict who/what can view the JSON API output).
- Operational
Rotate/replace any Satellite compute resources credentials that may have been exposed via the leaked Azure Resource Manager secret key in the API output.
Event History
Frequently Asked Questions
What is CVE-2021-3413?
CVE-2021-3413 is a vulnerability found in Red Hat Satellite in tfm-rubygem-foreman_azure_rm before version 2.2.0.
What is the severity of CVE-2021-3413?
The severity of CVE-2021-3413 is medium, with a CVSS score of 6.3.
What is the impact of CVE-2021-3413?
The highest threat from CVE-2021-3413 is to data confidentiality and integrity.
How can I fix CVE-2021-3413?
To fix CVE-2021-3413, update to version 2.2.0 or later of tfm-rubygem-foreman_azure_rm.
Where can I find more information about CVE-2021-3413?
More information about CVE-2021-3413 can be found at the following references: [link1](https://access.redhat.com/security/updates/classification), [link2](https://access.redhat.com/errata/RHSA-2021:4702), [link3](https://bugzilla.redhat.com/show_bug.cgi?id=1930352).