REDHAT-BUG-2513020: Medium severity insights-core vulnerability
A flaw was found in insights-core. The password redaction layer in insights/cleaner/password.py only recognizes credentials keyed under the literal string 'password'. SSSD's ldapdefaultauthtok and Pacemaker CIB fence device credentials stored as XML attributes (name="passwd" value="...") bypass the redaction entirely. Because the sssdconfig, sssdconfd, and cibxml specs are not declared filterable, the full file contents pass through the cleaner unmodified, and these credentials are included in cleartext in archives uploaded to console.redhat.com. This allows anyone with access to the uploaded archives to read LDAP bind passwords and cluster fence device credentials (IPMI, iLO, DRAC, vCenter). The default insights-client configuration is affected with no non-default settings required.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2513020?
The severity of REDHAT-BUG-2513020 is medium with a score of 4.
What vulnerability does REDHAT-BUG-2513020 address?
REDHAT-BUG-2513020 addresses a flaw in insights-core's password redaction layer.
How do I fix REDHAT-BUG-2513020?
To fix REDHAT-BUG-2513020, update insights-core to the latest version that addresses this vulnerability.
What are the implications of REDHAT-BUG-2513020?
The implications of REDHAT-BUG-2513020 include potential unauthorized access due to credential information not being redacted properly.
What components are affected by REDHAT-BUG-2513020?
Components affected by REDHAT-BUG-2513020 include the password redaction functionality in insights/cleaner/password.py.