Описание
A flaw was found in the OCAPI modules (ocapi_command, ocapi_info) of the community.general Ansible collection. The shared OCAPI request helper disables TLS certificate validation on every request and the modules expose no parameter to re-enable it, while sending HTTP Basic-Auth credentials to an https endpoint. An attacker positioned on the network path between the Ansible controller and the OCAPI-managed storage/enclosure device can present any certificate, intercept the session, capture the credentials, and tamper with responses.
Отчет
This issue affects the community.general collection, community-maintained content not shipped in a Red Hat-supported execution environment for Ansible Automation Platform nor in RHEL AppStream. Exploitation requires an on-path network position between the Ansible controller and the OCAPI-managed device.
Меры по смягчению последствий
Until fixed, only run the OCAPI modules against devices reached over a fully trusted/isolated management network path (no untrusted on-path segments), since certificate validation cannot be enabled. Treat the OCAPI Basic-Auth credentials as exposable in transit and rotate if MITM exposure is suspected.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Ceph Storage 5 | ansible-collection-community-general | Fix deferred | ||
| Red Hat Ceph Storage 9 | ansible-collection-community-general | Fix deferred | ||
| Red Hat OpenStack Platform 17.1 | ansible-collection-community-general | Fix deferred | ||
| Red Hat OpenStack Platform 18.0 | ansible-collection-community-general | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
6.8 Medium
CVSS3
Связанные уязвимости
(A flaw was found in the OCAPI modules (ocapi_command, ocapi_info) of t ...)
A flaw was found in the OCAPI modules (ocapi_command, ocapi_info) of the community.general Ansible collection. The shared OCAPI request helper disables TLS certificate validation on every request and the modules expose no parameter to re-enable it, while sending HTTP Basic-Auth credentials to an https endpoint. An attacker positioned on the network path between the Ansible controller and the OCAPI-managed storage/enclosure device can present any certificate, intercept the session, capture the credentials, and tamper with responses.
A flaw was found in the OCAPI modules (ocapi_command, ocapi_info) of t ...
A flaw was found in the OCAPI modules (ocapi_command, ocapi_info) of the community.general Ansible collection. The shared OCAPI request helper disables TLS certificate validation on every request and the modules expose no parameter to re-enable it, while sending HTTP Basic-Auth credentials to an https endpoint. An attacker positioned on the network path between the Ansible controller and the OCAPI-managed storage/enclosure device can present any certificate, intercept the session, capture the credentials, and tamper with responses.
EPSS
6.8 Medium
CVSS3