Description
A flaw was found in the OCAPI modules (ocapi_command, ocapi_info) of the community.general Ansible collection. The shared OCAPI request helper disables TLS certificate validation on every request and the modules expose no parameter to re-enable it, while sending HTTP Basic-Auth credentials to an https endpoint. An attacker positioned on the network path between the Ansible controller and the OCAPI-managed storage/enclosure device can present any certificate, intercept the session, capture the credentials, and tamper with responses.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Red Hat Red Hat Ceph Storage 5
Default version status: affected
Red Hat Red Hat Ceph Storage 9
Default version status: affected
Red Hat Red Hat OpenStack Platform 17.1
Default version status: affected
Red Hat Red Hat OpenStack Platform 18.0
Default version status: affected