From ce30f79252e9214080f99545a9c2cee2c9dc0d9e Mon Sep 17 00:00:00 2001 From: Al Snow <43523+jasnow@users.noreply.github.com> Date: Sun, 8 Nov 2026 12:59:55 -0500 Subject: [PATCH 1/4] One new foreman_azure_rm gem advisory --- gems/foreman_azure_rm/CVE-2021-3413.yml | 31 +++++++++++++++++++++++++ 1 file changed, 31 insertions(+) create mode 100644 gems/foreman_azure_rm/CVE-2021-3413.yml diff --git a/gems/foreman_azure_rm/CVE-2021-3413.yml b/gems/foreman_azure_rm/CVE-2021-3413.yml new file mode 100644 index 0000000000..46eb38aee1 --- /dev/null +++ b/gems/foreman_azure_rm/CVE-2021-3413.yml @@ -0,0 +1,31 @@ +--- +gem: foreman_azure_rm +cve: 2021-3413 +ghsa: gphm-f2cq-m9pv +url: https://nvd.nist.gov/vuln/detail/CVE-2021-3413 +title: Credential leak in tfm-rubygem-foreman_azure_rm +date: 2021-03-24 +description: | + A flaw was found in Red Hat Satellite in tfm-rubygem-foreman_azure_rm + in versions before 2.2.0. A credential leak was identified which + will expose Azure Resource Manager's secret key through JSON of + the API output. The highest threat from this vulnerability is to + data confidentiality and integrity as well as system availability. +cvss_v2: 6.5 +cvss_v3: 6.3 +patched_versions: + - ">= 2.2.0" +related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2021-3413 + - https://rubygems.org/gems/foreman_azure_rm/versions/2.2.0 + - https://github.com/theforeman/foreman_azure_rm/compare/v2.1.3...v2.2.0 + - https://github.com/theforeman/foreman_azure_rm/pull/103 (3/1/21) + - https://access.redhat.com/errata/RHSA-2021:4702 + - https://bugzilla.redhat.com/show_bug.cgi?id=1930352 + - https://github.com/advisories/GHSA-gphm-f2cq-m9pv +notes: | + - "Moderate" severity in GHSA URL. + - cvss_v2 and cvss_v3 from nvd.nist.gov URL. + - date from GHSA URL. + - Found PR reference in /compare/ URL. From 310a25969712bd794e1f14ed72a9e9a159348595 Mon Sep 17 00:00:00 2001 From: Al Snow <43523+jasnow@users.noreply.github.com> Date: Sun, 8 Nov 2026 13:01:40 -0500 Subject: [PATCH 2/4] Added ignore file change too --- lib/rad-ignores.sh | 1 - 1 file changed, 1 deletion(-) diff --git a/lib/rad-ignores.sh b/lib/rad-ignores.sh index 2b9ce4e451..36f47be410 100755 --- a/lib/rad-ignores.sh +++ b/lib/rad-ignores.sh @@ -211,7 +211,6 @@ rm -f gems/kobako/CVE-2026-55107.yml # #...................................................................... # # Redhat # GHSA-3fcg-qm7h-hhpw (red hat #3) -# GHSA-gphm-f2cq-m9pv (red hat #2) # GHSA-w5v4-7h7x-xfvq (red hat #1) # GHSA-h459-7mrx-8pvc - CVE-2014-0241 (Red hat plugin, not ruby lang) # GHSA-f29j-vf7h-f9g9 - CVE-2013-1945 (Red hat/Ruby 1.9.3) From a663c227c296bff34f8ffeba0ab9a85cbb564103 Mon Sep 17 00:00:00 2001 From: Al Snow <43523+jasnow@users.noreply.github.com> Date: Mon, 9 Nov 2026 07:52:35 -0500 Subject: [PATCH 3/4] Removed extra text at end of URL --- gems/foreman_azure_rm/CVE-2021-3413.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gems/foreman_azure_rm/CVE-2021-3413.yml b/gems/foreman_azure_rm/CVE-2021-3413.yml index 46eb38aee1..2bf21120f3 100644 --- a/gems/foreman_azure_rm/CVE-2021-3413.yml +++ b/gems/foreman_azure_rm/CVE-2021-3413.yml @@ -20,7 +20,7 @@ related: - https://nvd.nist.gov/vuln/detail/CVE-2021-3413 - https://rubygems.org/gems/foreman_azure_rm/versions/2.2.0 - https://github.com/theforeman/foreman_azure_rm/compare/v2.1.3...v2.2.0 - - https://github.com/theforeman/foreman_azure_rm/pull/103 (3/1/21) + - https://github.com/theforeman/foreman_azure_rm/pull/103 - https://access.redhat.com/errata/RHSA-2021:4702 - https://bugzilla.redhat.com/show_bug.cgi?id=1930352 - https://github.com/advisories/GHSA-gphm-f2cq-m9pv From ce84cac8163b8c48785ddcbe13c134e867032669 Mon Sep 17 00:00:00 2001 From: Al Snow <43523+jasnow@users.noreply.github.com> Date: Mon, 9 Nov 2026 07:55:47 -0500 Subject: [PATCH 4/4] Update CVE-2021-3413 date and reference source Updated the date of the CVE entry from 2021-03-24 to 2021-04-08 and corrected the source of the date reference. --- gems/foreman_azure_rm/CVE-2021-3413.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/gems/foreman_azure_rm/CVE-2021-3413.yml b/gems/foreman_azure_rm/CVE-2021-3413.yml index 2bf21120f3..81499c6587 100644 --- a/gems/foreman_azure_rm/CVE-2021-3413.yml +++ b/gems/foreman_azure_rm/CVE-2021-3413.yml @@ -4,7 +4,7 @@ cve: 2021-3413 ghsa: gphm-f2cq-m9pv url: https://nvd.nist.gov/vuln/detail/CVE-2021-3413 title: Credential leak in tfm-rubygem-foreman_azure_rm -date: 2021-03-24 +date: 2021-04-08 description: | A flaw was found in Red Hat Satellite in tfm-rubygem-foreman_azure_rm in versions before 2.2.0. A credential leak was identified which @@ -27,5 +27,5 @@ related: notes: | - "Moderate" severity in GHSA URL. - cvss_v2 and cvss_v3 from nvd.nist.gov URL. - - date from GHSA URL. + - date from nvd.nist.gov URL. - Found PR reference in /compare/ URL.