ansible
15 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2024-1657 | < 2.4 | Platform: insecure websocket used when interacting with eda server | HIGH 8.1 | 0.4 % | ||
| CVE-2024-0690 | 2.14.0 – < 2.14.4 ; 2.15.0 – < 2.15.9 ; 2.16.0 – < 2.16.3 | Ansible-core: possible information leak in tasks that ignore ansible_no_log configuration | MEDIUM 5.5 | 0.3 % | ||
| CVE-2021-3681 | ansible 3.3.0 | A flaw was found in Ansible Galaxy Collections. When collections are built manually, any files in the repository directory that are not expl | MEDIUM 5.5 | 0.2 % | ||
| CVE-2021-20180 | Fixed in ansible 2.9.18 | A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature w | MEDIUM 5.5 | 0.3 % | ||
| CVE-2021-3620 | Fixed in Ansible Engine v2.9.27 | A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is disclose | MEDIUM 5.5 | 0.4 % | ||
| CVE-2021-3583 | ansible_tower 3.7, ansible_engine 2.9.23 | A flaw was found in Ansible, where a user's controller is vulnerable to template injection. This issue can occur through facts used in the t | HIGH 7.1 | 0.9 % | ||
| CVE-2020-10729 | ansible-engine 2.9.6 | A flaw was found in the use of insufficiently random values in Ansible. Two random password lookups of the same length generate the equal va | MEDIUM 5.5 | 0.4 % | ||
| CVE-2021-20191 | ansible 2.9.18 | A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature | MEDIUM 5.5 | 0.3 % | ||
| CVE-2021-20178 | before 2.9.18 | A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature w | MEDIUM 5.5 | 0.3 % | ||
| CVE-2021-20228 | ansible-engine 2.9.18 | A flaw was found in the Ansible Engine 2.9.18, where sensitive info is not masked by default and is not protected by the no_log feature when | HIGH 7.5 | 2.1 % | ||
| CVE-2021-3447 | Red Hat Ansible Automation Platform 1.2.2, Ansible Tower 3.8.2 | A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged in plain-text on ma | MEDIUM 5.5 | 0.3 % | ||
| CVE-2020-14365 | ansible-engine 2.8.15, ansible-engine 2.9.13 | A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packag | HIGH 7.1 | 0.2 % | ||
| CVE-2019-14904 | All versions before ansible-engine 2.9.4, before ansible-engine 2.8.8 and before ansible-engine 2.7.16 | A flaw was found in the solaris_zone module from the Ansible Community modules. When setting the name for the zone on the Solaris host, the | HIGH 7.3 | 0.4 % | ||
| CVE-2014-4678 | before 1.6.4 | The safe_eval function in Ansible before 1.6.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrar | CRITICAL 9.8 | 5.2 % | ||
| CVE-2016-9587 | ansible 2.1.4 ; ansible 2.2.1 | Ansible before versions 2.1.4, 2.2.1 is vulnerable to an improper input validation in Ansible's handling of data sent from client systems. A | HIGH 8.1 | 17 % |