Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

RubyGems package

foreman_ansible

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.0RubyGemsPublished

    Missing Authentication for Critical Function in Foreman Ansible

    CVE-2021-3589 · GHSA-vvff-6wrr-4g7q

    Affected
    • RubyGems foreman_ansible < 2.0.0
    Fixed in
    2.0.0· Vendor fix available
    Issue
    An authorization flaw was found in Foreman Ansible. An authenticated attacker with certain permissions to create and run Ansible jobs can access hosts through job templates. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

    Recommended action: Upgrade to 2.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →