Security Bulletin: Vulnerability in Ansible bundled with IBM Spectrum Fusion HCI

Summary

IBM Spectrum Fusion includes Ansible which could allow a local authenticated attacker to obtain sensitive information, caused by a flaw in the ansible-connection module (CVE-2021-3620)

Vulnerability Details

CVEID:CVE-2021-3620
**DESCRIPTION:**Red Hat Ansible Engine could allow a local authenticated attacker to obtain sensitive information, caused by a flaw in the ansible-connection module. An attacker could exploit this vulnerability to obtain user credentials from the traceback error message and use this information to launch further attacks against the affected system.
CVSS Base score: 5.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/221032 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Affected Products and Versions

Remediation/Fixes

Workarounds and Mitigations

None