Information Exposure Through Log Files Affecting golang-github-prometheus-node_exporter package, versions <1.3.0-150000.3.15.1


Severity

Recommended
0.0
medium
0
10

Based on SUSE Linux Enterprise Server security rating

    Threat Intelligence

    EPSS
    0.05% (19th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-SLES150-GOLANGGITHUBPROMETHEUSNODEEXPORTER-3019855
  • published 9 Sep 2022
  • disclosed 8 Sep 2022

How to fix?

Upgrade SLES:15.0 golang-github-prometheus-node_exporter to version 1.3.0-150000.3.15.1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream golang-github-prometheus-node_exporter package and not the golang-github-prometheus-node_exporter package as distributed by SLES. See How to fix? for SLES:15.0 relevant fixed versions and status.

A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged in plain-text on managed nodes, as well as being made visible on the controller node when run in verbose mode. These parameters were not protected by the no_log feature. An attacker can take advantage of this information to steal those credentials, provided when they have access to the log files containing them. The highest threat from this vulnerability is to data confidentiality. This flaw affects Red Hat Ansible Automation Platform in versions before 1.2.2 and Ansible Tower in versions before 3.8.2.

CVSS Scores

version 3.1
Expand this section

NVD

5.5 medium
  • Attack Vector (AV)
    Local
  • Attack Complexity (AC)
    Low
  • Privileges Required (PR)
    Low
  • User Interaction (UI)
    None
  • Scope (S)
    Unchanged
  • Confidentiality (C)
    High
  • Integrity (I)
    None
  • Availability (A)
    None
Expand this section

SUSE

5 medium
Expand this section

Red Hat

5 medium