CVE-2021-20180
published 2022-03-16CVE-2021-20180: A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the…
PriorityP427medium5.5CVSS 3.1
AVLACLPRLUINSUCHINAN
EPSS
0.31%
22.7th percentile
A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucket_pipeline_variable module. This flaw allows an attacker to steal bitbucket_pipeline credentials. The highest threat from this vulnerability is to confidentiality.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | ansible | < ansible 2.10.7-1 (bookworm) | ansible 2.10.7-1 (bookworm) |
| redhat | ansible | < 2.9.18 | 2.9.18 |
| redhat | ansible | — | — |
| redhat | ansible | >= 0 < 2.10.7-1 | 2.10.7-1 |
| redhat | ansible | >= 0 < 2.10.7-1 | 2.10.7-1 |
| redhat | ansible | >= 0 < 2.10.7-1 | 2.10.7-1 |
| redhat | ansible | >= 0 < 2.10.7-1 | 2.10.7-1 |
| redhat | ansible | >= 2.8.0a1 < 2.8.19 | 2.8.19 |
| redhat | ansible | >= 2.9.0b1 < 2.9.18 | 2.9.18 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:P/I:N/A:N
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Insertion of Sensitive Information into Log File in ansible
osv·2022-03-17
CVE-2021-20180 [MEDIUM] Insertion of Sensitive Information into Log File in ansible
Insertion of Sensitive Information into Log File in ansible
A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucket_pipeline_variable module. This flaw allows an attacker to steal bitbucket_pipeline credentials. The highest threat from this vulnerability is to confidentiality.
GHSA
Insertion of Sensitive Information into Log File in ansible
ghsa·2022-03-17
CVE-2021-20180 [MEDIUM] CWE-532 Insertion of Sensitive Information into Log File in ansible
Insertion of Sensitive Information into Log File in ansible
A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucket_pipeline_variable module. This flaw allows an attacker to steal bitbucket_pipeline credentials. The highest threat from this vulnerability is to confidentiality.
OSV
CVE-2021-20180: A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using
osv·2022-03-16·CVSS 5.5
CVE-2021-20180 [MEDIUM] CVE-2021-20180: A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using
A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucket_pipeline_variable module. This flaw allows an attacker to steal bitbucket_pipeline credentials. The highest threat from this vulnerability is to confidentiality.
Red Hat
module: bitbucket_pipeline_variable exposes secured values
vendor_redhat·2021-01-13·CVSS 5.5
CVE-2021-20180 [MEDIUM] CWE-532 module: bitbucket_pipeline_variable exposes secured values
module: bitbucket_pipeline_variable exposes secured values
A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucket_pipeline_variable module. This flaw allows an attacker to steal bitbucket_pipeline credentials. The highest threat from this vulnerability is to confidentiality.
A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucket_pipeline_variable module. This flaw allows an attacker to steal bitbucket_pipeline credentials. The highest threat from this vulnerability is to confidentiality.
Statement: The version of Ansible provided in Red Hat Gluster Storage 3 does not conta
Debian
CVE-2021-20180: ansible - A flaw was found in ansible module where credentials are disclosed in the consol...
vendor_debian·2021·CVSS 5.5
CVE-2021-20180 [MEDIUM] CVE-2021-20180: ansible - A flaw was found in ansible module where credentials are disclosed in the consol...
A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucket_pipeline_variable module. This flaw allows an attacker to steal bitbucket_pipeline credentials. The highest threat from this vulnerability is to confidentiality.
Scope: local
bookworm: resolved (fixed in 2.10.7-1)
bullseye: resolved (fixed in 2.10.7-1)
forky: resolved (fixed in 2.10.7-1)
sid: resolved (fixed in 2.10.7-1)
trixie: resolved (fixed in 2.10.7-1)
No detection rules found.
No public exploits indexed.
2022-03-16
Published