ansible
En bref
- Source
- NVD
- EPSS
- EPSS 0.35 % · centile 29 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- redhat
- Statut NVD
- Modified
Description
A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest threat from this vulnerability is to data confidentiality. Versions before ansible 2.9.18 are affected.
Faiblesses (CWE)
- CWE-532 — Informations sensibles insérées dans un fichier de journal
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | LOW 2.1 | AV:L/AC:L/Au:N/C:P/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-8f4m-hccc-8qph — Insertion of Sensitive Information into Log File in ansible
- PYSEC-2021-124 — A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those mo
Références européennes
- ENISA EUVD · EUVD-2021-0008
- GCVE · GCVE-0-2021-20191
Configurations affectées (CPE NVD)
cpe:2.3:a:oracle:virtualization:4.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*< 2.8.19cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*≥ 2.9.0 < 2.9.18cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*≥ 2.10.0 < 2.10.7cpe:2.3:a:redhat:ansible_tower:3.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:cisco_nx-os_collection:*:*:*:*:*:*:*:*< 1.4.0cpe:2.3:a:redhat:community_general_collection:*:*:*:*:*:ansible:*:*< 1.3.6cpe:2.3:a:redhat:community_general_collection:*:*:*:*:*:ansible:*:*≥ 2.0.0 < 2.0.1cpe:2.3:a:redhat:community_network_collection:*:*:*:*:*:ansible:*:*< 1.3.2cpe:2.3:a:redhat:community_network_collection:*:*:*:*:*:ansible:*:*≥ 2.0.0 < 2.0.1cpe:2.3:a:redhat:docker_community_collection:*:*:*:*:*:ansible:*:*< 1.2.2cpe:2.3:a:redhat:google_cloud_platform_ansible_collection:1.0.2:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| ansible | affected ansible 2.9.18 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |