Information Exposure Through Log Files Affecting golang-github-prometheus-node_exporter package, versions <1.3.0-150000.3.15.1


Severity

Recommended
0.0
medium
0
10

Based on SUSE Linux Enterprise Server security rating.

Threat Intelligence

EPSS
0.05% (20th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Information Exposure Through Log Files vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-SLES150-GOLANGGITHUBPROMETHEUSNODEEXPORTER-3019855
  • published9 Sept 2022
  • disclosed8 Sept 2022

Introduced: 8 Sep 2022

CVE-2021-3447  (opens in a new tab)
CWE-532  (opens in a new tab)

How to fix?

Upgrade SLES:15.0 golang-github-prometheus-node_exporter to version 1.3.0-150000.3.15.1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream golang-github-prometheus-node_exporter package and not the golang-github-prometheus-node_exporter package as distributed by SLES. See How to fix? for SLES:15.0 relevant fixed versions and status.

A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged in plain-text on managed nodes, as well as being made visible on the controller node when run in verbose mode. These parameters were not protected by the no_log feature. An attacker can take advantage of this information to steal those credentials, provided when they have access to the log files containing them. The highest threat from this vulnerability is to data confidentiality. This flaw affects Red Hat Ansible Automation Platform in versions before 1.2.2 and Ansible Tower in versions before 3.8.2.

CVSS Scores

version 3.1