RHSA-2021:2119: Red Hat Security Advisory: Red Hat OpenStack Platform 16.1.6 (tripleo-ansible) security update

An update for tripleo-ansible is now available for Red Hat OpenStack Platform 16.1 (Train). Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.Ansible project for TripleO. Security Fix(es):

• ansible.log file is visible to unprivileged users (CVE-2021-31918) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page listed in the References section. Changes to the tripleo-ansible component: This update prevents Relax and Recover (ReaR) from automatically creating an unrequested backup. Previously, ReaR automatically created the cron file /etc/cron.d/rear, which ran a backup at 1:30 AM. This update prevents the automatic creation of the cron job. (BZ#1919174) Related CVEs:
• CVE-2021-31918: tripleo-ansible: ansible.log file is visible to unprivileged users