diff --git a/gems/foreman_azure_rm/CVE-2021-3413.yml b/gems/foreman_azure_rm/CVE-2021-3413.yml new file mode 100644 index 0000000000..81499c6587 --- /dev/null +++ b/gems/foreman_azure_rm/CVE-2021-3413.yml @@ -0,0 +1,31 @@ +--- +gem: foreman_azure_rm +cve: 2021-3413 +ghsa: gphm-f2cq-m9pv +url: https://nvd.nist.gov/vuln/detail/CVE-2021-3413 +title: Credential leak in tfm-rubygem-foreman_azure_rm +date: 2021-04-08 +description: | + A flaw was found in Red Hat Satellite in tfm-rubygem-foreman_azure_rm + in versions before 2.2.0. A credential leak was identified which + will expose Azure Resource Manager's secret key through JSON of + the API output. The highest threat from this vulnerability is to + data confidentiality and integrity as well as system availability. +cvss_v2: 6.5 +cvss_v3: 6.3 +patched_versions: + - ">= 2.2.0" +related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2021-3413 + - https://rubygems.org/gems/foreman_azure_rm/versions/2.2.0 + - https://github.com/theforeman/foreman_azure_rm/compare/v2.1.3...v2.2.0 + - https://github.com/theforeman/foreman_azure_rm/pull/103 + - https://access.redhat.com/errata/RHSA-2021:4702 + - https://bugzilla.redhat.com/show_bug.cgi?id=1930352 + - https://github.com/advisories/GHSA-gphm-f2cq-m9pv +notes: | + - "Moderate" severity in GHSA URL. + - cvss_v2 and cvss_v3 from nvd.nist.gov URL. + - date from nvd.nist.gov URL. + - Found PR reference in /compare/ URL. diff --git a/lib/rad-ignores.sh b/lib/rad-ignores.sh index 2b9ce4e451..36f47be410 100755 --- a/lib/rad-ignores.sh +++ b/lib/rad-ignores.sh @@ -211,7 +211,6 @@ rm -f gems/kobako/CVE-2026-55107.yml # #...................................................................... # # Redhat # GHSA-3fcg-qm7h-hhpw (red hat #3) -# GHSA-gphm-f2cq-m9pv (red hat #2) # GHSA-w5v4-7h7x-xfvq (red hat #1) # GHSA-h459-7mrx-8pvc - CVE-2014-0241 (Red hat plugin, not ruby lang) # GHSA-f29j-vf7h-f9g9 - CVE-2013-1945 (Red hat/Ruby 1.9.3)