GHSA-vvff-6wrr-4g7q

Missing Authentication for Critical Function in Foreman Ansible

Source: GitHub Advisory Database (reviewed) High CVE-2021-3589

Packages

Ecosystem	Package	Affected	Fixed in
RubyGems	foreman_ansible	< 2.0.0	2.0.0

Details

As written in the advisory (Markdown source, shown as plain text).

An authorization flaw was found in Foreman Ansible. An authenticated attacker with certain permissions to create and run Ansible jobs can access hosts through job templates. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-3589 advisory
https://github.com/theforeman/foreman_ansible/commit/a5e0827bc3ec6c8ab82f968907857a15646305d5 web
https://access.redhat.com/security/cve/CVE-2021-3589 web
https://bugzilla.redhat.com/show_bug.cgi?id=1969265 web
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/foreman_ansible/CVE-2021-3589.yml web
https://github.com/theforeman/foreman_ansible package