-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

====================================================================                   Red Hat Security Advisory

Synopsis:          Moderate: Red Hat Ansible Automation Platform Operator 1.2 security update
Advisory ID:       RHSA-2021:1079-01
Product:           Red Hat Ansible Automation Platform
Advisory URL:      https://access.redhat.com/errata/RHSA-2021:1079
Issue date:        2021-04-06
Keywords:          Security Update
CVE Names:         CVE-2017-12652 CVE-2018-20843 CVE-2019-5094 
                   CVE-2019-5188 CVE-2019-11719 CVE-2019-11727 
                   CVE-2019-11756 CVE-2019-12749 CVE-2019-14866 
                   CVE-2019-14973 CVE-2019-15903 CVE-2019-17006 
                   CVE-2019-17023 CVE-2019-17498 CVE-2019-17546 
                   CVE-2019-19956 CVE-2019-20388 CVE-2019-20907 
                   CVE-2020-1971 CVE-2020-5313 CVE-2020-6829 
                   CVE-2020-7595 CVE-2020-8177 CVE-2020-8625 
                   CVE-2020-12243 CVE-2020-12400 CVE-2020-12401 
                   CVE-2020-12402 CVE-2020-12403 CVE-2020-14422 
                   CVE-2020-15999 CVE-2021-3156 CVE-2021-3447 
                   CVE-2021-20178 CVE-2021-20180 CVE-2021-20191 
                   CVE-2021-20228 
====================================================================
1. Summary:

Red Hat Ansible Automation Platform Resource Operator 1.2 (technical
preview) images that fix several security issues.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Description:

Red Hat Ansible Automation Platform Resource Operator container images 
with security fixes.

Ansible Automation Platform manages Ansible Platform jobs and workflows
that can interface with any infrastructure on a Red Hat OpenShift Container
Platform cluster, or on a traditional infrastructure that is running
off-cluster.

Security fixes:

CVE-2021-20191 ansible: multiple modules expose secured values
[ansible_automation_platform-1.2] (BZ#1916813)

CVE-2021-20178 ansible: user data leak in snmp_facts module
[ansible_automation_platform-1.2] (BZ#1914774)

CVE-2021-20180 ansible: ansible module: bitbucket_pipeline_variable exposes
secured values [ansible_automation_platform-1.2] (BZ#1915808)

CVE-2021-20228 ansible: basic.py no_log with fallback option
[ansible_automation_platform-1.2] (BZ#1925002)

CVE-2021-3447 ansible: multiple modules expose secured values
[ansible_automation_platform-1.2] (BZ#1939349)

For more details about the security issue, including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

3. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

4. Bugs fixed (https://bugzilla.redhat.com/):

1914774 - CVE-2021-20178 ansible: user data leak in snmp_facts module
1915808 - CVE-2021-20180 ansible module: bitbucket_pipeline_variable exposes secured values
1916813 - CVE-2021-20191 ansible: multiple modules expose secured values
1925002 - CVE-2021-20228 ansible: basic.py no_log with fallback option
1939349 - CVE-2021-3447 ansible: multiple modules expose secured values

5. References:

https://access.redhat.com/security/cve/CVE-2017-12652
https://access.redhat.com/security/cve/CVE-2018-20843
https://access.redhat.com/security/cve/CVE-2019-5094
https://access.redhat.com/security/cve/CVE-2019-5188
https://access.redhat.com/security/cve/CVE-2019-11719
https://access.redhat.com/security/cve/CVE-2019-11727
https://access.redhat.com/security/cve/CVE-2019-11756
https://access.redhat.com/security/cve/CVE-2019-12749
https://access.redhat.com/security/cve/CVE-2019-14866
https://access.redhat.com/security/cve/CVE-2019-14973
https://access.redhat.com/security/cve/CVE-2019-15903
https://access.redhat.com/security/cve/CVE-2019-17006
https://access.redhat.com/security/cve/CVE-2019-17023
https://access.redhat.com/security/cve/CVE-2019-17498
https://access.redhat.com/security/cve/CVE-2019-17546
https://access.redhat.com/security/cve/CVE-2019-19956
https://access.redhat.com/security/cve/CVE-2019-20388
https://access.redhat.com/security/cve/CVE-2019-20907
https://access.redhat.com/security/cve/CVE-2020-1971
https://access.redhat.com/security/cve/CVE-2020-5313
https://access.redhat.com/security/cve/CVE-2020-6829
https://access.redhat.com/security/cve/CVE-2020-7595
https://access.redhat.com/security/cve/CVE-2020-8177
https://access.redhat.com/security/cve/CVE-2020-8625
https://access.redhat.com/security/cve/CVE-2020-12243
https://access.redhat.com/security/cve/CVE-2020-12400
https://access.redhat.com/security/cve/CVE-2020-12401
https://access.redhat.com/security/cve/CVE-2020-12402
https://access.redhat.com/security/cve/CVE-2020-12403
https://access.redhat.com/security/cve/CVE-2020-14422
https://access.redhat.com/security/cve/CVE-2020-15999
https://access.redhat.com/security/cve/CVE-2021-3156
https://access.redhat.com/security/cve/CVE-2021-3447
https://access.redhat.com/security/cve/CVE-2021-20178
https://access.redhat.com/security/cve/CVE-2021-20180
https://access.redhat.com/security/cve/CVE-2021-20191
https://access.redhat.com/security/cve/CVE-2021-20228
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/security/cve/CVE-2021-20191
https://access.redhat.com/security/cve/CVE-2021-20178
https://access.redhat.com/security/cve/CVE-2021-20180
https://access.redhat.com/security/cve/CVE-2021-20228
https://access.redhat.com/security/cve/CVE-2021-3447

6. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2021 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYHBeatzjgjWX9erEAQhLuw//QLV4QWc4E9o8cG3IJr3xIt6b/OHs6b9s
hp04e5kT7IWFpmR3VXK+BEK2dd+NiGdvXPOpwe4BaOUWEDmq+dx4Vac5Z0GcZJUK
AJz8dXFPYBgIafuIkWyY9UIvSO/VsQ2Dr4+KUnB1obALAz3ndSoQJFS1hysFBXHS
+MulKiYVwFw7UbfvGuFLjmLrNTAflVa9MHmdh3P53bU+U2mCgzuHTFIpodkZhuIt
aIR0H/dgHXXG8co20Zb5Nciqr0CxqejQ+xz84Yu0I+y1LWdBAhi34c3zJY4rlEQS
6/nfcsSPEadNCTXQu/TX6yvo6sE8A7/xGh1PDf0PLVv+Xh7TE53MtmTnYcl8uiRO
9m3CfJ7PLO2hpl6QuJzuUe7nXx65/qIoKQjZfNpZVXj/LQtL1F4RE7szmswIGNZL
IG51pYEUE98aR3gIlLpoMjW4vtC+rdcwSBaLW5gH1Q5hNRlTLmFBTKmYNkCpd4Ho
NP3AKEwx9R8ZdGYcCuZwYPvSQSqX+B9qURw5G4E/vbso8Vh9RYQ3kusnf93Q/1LG
ImHCbsVWJDMMt/NRj5OvqgZc18ROqHhSpuJ+A44VCI+UihkZb2ai4DjGef0WHZhq
XTMyLECTJIwM4aY+BC1ohYm0Whvs/w/hd03tGFBJhlIoBYakY6o8lRD7hCc8E/YI
dEQ0aSabgEY=D/Lt
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://listman.redhat.com/mailman/listinfo/rhsa-announce