Описание
A flaw was found in insights-core where the password redaction layer fails to recognize credentials not keyed under the literal string 'password'. This allows SSSD LDAP bind passwords (ldap_default_authtok) and Pacemaker fence device credentials to be included in cleartext in archives uploaded to console.redhat.com.
Отчет
This Moderate flaw in insights-core allows SSSD LDAP bind passwords and Pacemaker CIB fence device credentials to be included in cleartext within archives uploaded by insights-client. The default insights-client configuration is affected, leading to potential exposure of sensitive credentials to individuals with access to these uploaded archives.
Меры по смягчению последствий
Exclude sssd_config, sssd_conf_d, and cib_xml via /etc/insights-client/file-redaction.yaml, or add keyword/pattern redaction covering ldap_default_authtok and fence passwd/password XML forms, until a patched insights-core is available.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Pen Drive Powered by Red Hat Lightspeed | pen-drive/pen-drive-scanner-rhel9 | Fix deferred | ||
| Pen Drive Powered by Red Hat Lightspeed | pen-drive/pen-drive-scanner-rhel9 | Fix deferred | ||
| Red Hat Certification Program for Red Hat Enterprise Linux 9 | rhcertification/redhat-certification-cloud-10 | Fix deferred | ||
| Red Hat Certification Program for Red Hat Enterprise Linux 9 | rhcertification/redhat-certification-cloud-9 | Fix deferred | ||
| Red Hat Enterprise Linux 10 | insights-core | Fix deferred | ||
| Red Hat Enterprise Linux 10 | rhel10-eus/rhel-10.2-bootc | Fix deferred | ||
| Red Hat Enterprise Linux 10 | rhel10/rhel-bootc | Fix deferred | ||
| Red Hat Enterprise Linux 9 | insights-core | Fix deferred | ||
| Red Hat Satellite 6 | satellite/iop-advisor-engine-rhel9 | Not affected | ||
| Red Hat Satellite 6 | satellite/iop-insights-engine-rhel9 | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
6.5 Medium
CVSS3
Связанные уязвимости
A flaw was found in insights-core where the password redaction layer fails to recognize credentials not keyed under the literal string 'password'. This allows SSSD LDAP bind passwords (ldap_default_authtok) and Pacemaker fence device credentials to be included in cleartext in archives uploaded to console.redhat.com.
A flaw was found in insights-core where the password redaction layer fails to recognize credentials not keyed under the literal string 'password'. This allows SSSD LDAP bind passwords (ldap_default_authtok) and Pacemaker fence device credentials to be included in cleartext in archives uploaded to console.redhat.com.
EPSS
6.5 Medium
CVSS3