zhmcclient zhmc-ansible-modules up to 1.9.2 Ansible cleartext storage

Summaryinfo

A vulnerability labeled as problematic has been found in zhmcclient zhmc-ansible-modules up to 1.9.2. The impacted element is an unknown function of the component Ansible Module. Such manipulation leads to cleartext storage. This vulnerability is documented as CVE-2024-53979. The attack needs to be performed locally. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in zhmcclient zhmc-ansible-modules up to 1.9.2. Affected by this issue is an unknown part of the component Ansible Module. The manipulation with an unknown input leads to a cleartext storage vulnerability. Using CWE to declare the problem leads to CWE-312. The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere. Impacted is confidentiality. CVE summarizes:

ibm.ibm_zhmc is an Ansible collection for the IBM Z HMC. The Ansible collection "ibm.ibm_zhmc" writes password-like properties in clear text into its log file and into the output returned by some of its Ansible module in the following cases: 1. The 'boot_ftp_password' and 'ssc_master_pw' properties are passed as input to the zhmc_partition Ansible module. 2. The 'ssc_master_pw' and 'zaware_master_pw' properties are passed as input to the zhmc_lpar Ansible module. 3. The 'password' property is passed as input to the zhmc_user Ansible module (just in log file, not in module output). 4. The 'bind_password' property is passed as input to the zhmc_ldap_server_definition Ansible module. These properties appear in the module output only when they were specified in the module input and when creating or updating the corresponding resources. They do not appear in the output when retrieving facts for the corresponding resources. These properties appear in the log file only when the "log_file" module input parameter is used. By default, no log file is created. This issue has been fixed in ibm.ibm_zhmc version 1.9.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2024-53979 since 11/26/2024. The exploitation is known to be easy. The attack needs to be approached locally. The exploitation needs additional levels of successful authentication. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1555.

Upgrading to version 1.9.3 eliminates this vulnerability. Applying the patch f5579f07da5f02d2496c41a313d4ae7a0a459b1d is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• zhmcclient

Name

• zhmc-ansible-modules

Version

• 1.9.0
• 1.9.1
• 1.9.2

License

• open-source

Website

• Product: https://github.com/zhmcclient/zhmc-ansible-modules/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion