CVE-2021-20191
published 2021-05-26CVE-2021-20191: A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those…
PriorityP427medium5.5CVSS 3.1
AVLACLPRLUINSUCHINAN
EPSS
0.35%
27.3th percentile
A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest threat from this vulnerability is to data confidentiality. Versions before ansible 2.9.18 are affected.
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | ansible | < ansible 2.10.7-1 (bookworm) | ansible 2.10.7-1 (bookworm) |
| msrc | cm1_ansible_2.9.18-1_on_cbl_mariner_1.0 | — | — |
| oracle | virtualization | — | — |
| redhat | ansible | < 2.8.19 | 2.8.19 |
| redhat | ansible | — | — |
| redhat | ansible | >= 0 < 2.10.7-1 | 2.10.7-1 |
| redhat | ansible | >= 0 < 2.10.7-1 | 2.10.7-1 |
| redhat | ansible | >= 0 < 2.10.7-1 | 2.10.7-1 |
| redhat | ansible | >= 0 < 2.10.7-1 | 2.10.7-1 |
| redhat | ansible | >= 0 < 2.8.19rc1 | 2.8.19rc1 |
| redhat | ansible | >= 2.10.0 < 2.10.7 | 2.10.7 |
| redhat | ansible | >= 2.10.0a1 < 2.10.7 | 2.10.7 |
| redhat | ansible | >= 2.9.0 < 2.9.18 | 2.9.18 |
| redhat | ansible | >= 2.9.0a1 < 2.9.18rc1 | 2.9.18rc1 |
| redhat | ansible_tower | — | — |
| redhat | cisco_nx-os_collection | < 1.4.0 | 1.4.0 |
| redhat | community_general_collection | < 1.3.6 | 1.3.6 |
| redhat | community_general_collection | >= 2.0.0 < 2.0.1 | 2.0.1 |
| redhat | community_network_collection | < 1.3.2 | 1.3.2 |
| redhat | community_network_collection | >= 2.0.0 < 2.0.1 | 2.0.1 |
| redhat | docker_community_collection | < 1.2.2 | 1.2.2 |
| redhat | google_cloud_platform_ansible_collection | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:P/I:N/A:N
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_msrc5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Insertion of Sensitive Information into Log File in ansible
osv·2021-06-01
CVE-2021-20191 [MEDIUM] Insertion of Sensitive Information into Log File in ansible
Insertion of Sensitive Information into Log File in ansible
A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest threat from this vulnerability is to data confidentiality.
GHSA
Insertion of Sensitive Information into Log File in ansible
ghsa·2021-06-01
CVE-2021-20191 [MEDIUM] CWE-532 Insertion of Sensitive Information into Log File in ansible
Insertion of Sensitive Information into Log File in ansible
A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest threat from this vulnerability is to data confidentiality.
OSV
CVE-2021-20191: A flaw was found in ansible
osv·2021-05-26·CVSS 5.5
CVE-2021-20191 [MEDIUM] CVE-2021-20191: A flaw was found in ansible
A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest threat from this vulnerability is to data confidentiality. Versions before ansible 2.9.18 are affected.
Microsoft
A flaw was found in ansible. Credentials such as secrets are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage of t
vendor_msrc·2021-05-11·CVSS 5.5
CVE-2021-20191 [MEDIUM] CWE-532 A flaw was found in ansible. Credentials such as secrets are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage of t
A flaw was found in ansible. Credentials such as secrets are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest threat from this vulnerability is to data confidentiality. Versions before ansible 2.9.18 are affected.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which i
Red Hat
ansible: multiple modules expose secured values
vendor_redhat·2021-01-15·CVSS 5.5
CVE-2021-20191 [MEDIUM] CWE-532 ansible: multiple modules expose secured values
ansible: multiple modules expose secured values
A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest threat from this vulnerability is to data confidentiality. Versions before ansible 2.9.18 are affected.
A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest threat from this vulnerability is to data confidentiality.
Statement: The version of ansible shipped with Red Hat Gluster Storage
Debian
CVE-2021-20191: ansible - A flaw was found in ansible. Credentials, such as secrets, are being disclosed i...
vendor_debian·2021·CVSS 5.5
CVE-2021-20191 [MEDIUM] CVE-2021-20191: ansible - A flaw was found in ansible. Credentials, such as secrets, are being disclosed i...
A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest threat from this vulnerability is to data confidentiality. Versions before ansible 2.9.18 are affected.
Scope: local
bookworm: resolved (fixed in 2.10.7-1)
bullseye: resolved (fixed in 2.10.7-1)
forky: resolved (fixed in 2.10.7-1)
sid: resolved (fixed in 2.10.7-1)
trixie: resolved (fixed in 2.10.7-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-05-26
Published