ansible
At a glance
- Source
- NVD
- EPSS
- EPSS 0.35 % · percentile 29 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- redhat
- NVD status
- Modified
Description
A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest threat from this vulnerability is to data confidentiality. Versions before ansible 2.9.18 are affected.
Weaknesses (CWE)
- CWE-532 — Insertion of Sensitive Information into Log File
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | LOW 2.1 | AV:L/AC:L/Au:N/C:P/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-8f4m-hccc-8qph — Insertion of Sensitive Information into Log File in ansible
- PYSEC-2021-124 — A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those mo
European references
- ENISA EUVD · EUVD-2021-0008
- GCVE · GCVE-0-2021-20191
Affected configurations (NVD CPE)
cpe:2.3:a:oracle:virtualization:4.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*< 2.8.19cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*≥ 2.9.0 < 2.9.18cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*≥ 2.10.0 < 2.10.7cpe:2.3:a:redhat:ansible_tower:3.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:cisco_nx-os_collection:*:*:*:*:*:*:*:*< 1.4.0cpe:2.3:a:redhat:community_general_collection:*:*:*:*:*:ansible:*:*< 1.3.6cpe:2.3:a:redhat:community_general_collection:*:*:*:*:*:ansible:*:*≥ 2.0.0 < 2.0.1cpe:2.3:a:redhat:community_network_collection:*:*:*:*:*:ansible:*:*< 1.3.2cpe:2.3:a:redhat:community_network_collection:*:*:*:*:*:ansible:*:*≥ 2.0.0 < 2.0.1cpe:2.3:a:redhat:docker_community_collection:*:*:*:*:*:ansible:*:*< 1.2.2cpe:2.3:a:redhat:google_cloud_platform_ansible_collection:1.0.2:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| ansible | affected ansible 2.9.18 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |