CVE-2021-3681: Medium severity redhat Ansible Automation Platform vulnerability
A flaw was found in Ansible Galaxy Collections. When collections are built manually, any files in the repository directory that are not explicitly excluded via the buildignore list in "galaxy.yml" include files in the .tar.gz file. This contains sensitive info, such as the user's Ansible Galaxy API key and any secrets in ansible or ansible-playbook verbose output without thenolog redaction. Currently, there is no way to deprecate a Collection Or delete a Collection Version. Once published, anyone who downloads or installs the collection can view the secrets.
Other sources
When someone is manually building collections, any files in the repository directory that are not explicitly excluded via the buildignore list in the galaxy.yml file will be included in the .tar.gz file which may include the user's Ansible Galaxy API key, any secrets in ansible or ansible-playbook verbose output without nolog redaction, or any other secrets that a developer unknowingly places in the repository directory while developing and testing the collection. Once published, anyone who downloads or installs the collection will possess the secrets.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-3681?
CVE-2021-3681 is a vulnerability found in Ansible Galaxy Collections that allows sensitive files to be included in the .tar.gz file when collections are built manually.
What is the severity of CVE-2021-3681?
The severity of CVE-2021-3681 is rated as high with a severity value of 5.5.
How does CVE-2021-3681 affect Redhat Ansible Automation Platform?
Redhat Ansible Automation Platform version 1.2 is affected by CVE-2021-3681.
How does CVE-2021-3681 affect Redhat Ansible Galaxy?
Redhat Ansible Galaxy version 3.3.0 is affected by CVE-2021-3681.
How can I fix CVE-2021-3681?
To fix CVE-2021-3681, make sure to explicitly exclude sensitive files via the "build_ignore" list in "galaxy.yml" when building collections manually in Ansible Galaxy.