CVE-2021-3447
published 2021-04-01CVE-2021-3447: A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged in plain-text on managed nodes, as…
PriorityP426medium5.5CVSS 3.1
AVLACLPRLUINSUCHINAN
EPSS
0.33%
25.8th percentile
A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged in plain-text on managed nodes, as well as being made visible on the controller node when run in verbose mode. These parameters were not protected by the no_log feature. An attacker can take advantage of this information to steal those credentials, provided when they have access to the log files containing them. The highest threat from this vulnerability is to data confidentiality. This flaw affects Red Hat Ansible Automation Platform in versions before 1.2.2 and Ansible Tower in versions before 3.8.2.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | ansible | < ansible 2.10.7+merged+base+2.10.8+dfsg-1 (bookworm) | ansible 2.10.7+merged+base+2.10.8+dfsg-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| redhat | ansible | < 1.2.2 | 1.2.2 |
| redhat | ansible | — | — |
| redhat | ansible | >= 0 < 2.10.7+merged+base+2.10.8+dfsg-1 | 2.10.7+merged+base+2.10.8+dfsg-1 |
| redhat | ansible | >= 0 < 2.10.7+merged+base+2.10.8+dfsg-1 | 2.10.7+merged+base+2.10.8+dfsg-1 |
| redhat | ansible | >= 0 < 2.10.7+merged+base+2.10.8+dfsg-1 | 2.10.7+merged+base+2.10.8+dfsg-1 |
| redhat | ansible | >= 0 < 2.10.7+merged+base+2.10.8+dfsg-1 | 2.10.7+merged+base+2.10.8+dfsg-1 |
| redhat | ansible_tower | < 3.8.2 | 3.8.2 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:P/I:N/A:N
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
ansible: multiple modules expose secured values
vendor_redhat·2021-03-16·CVSS 5.5
CVE-2021-3447 [MEDIUM] CWE-532 ansible: multiple modules expose secured values
ansible: multiple modules expose secured values
A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged in plain-text on managed nodes, as well as being made visible on the controller node when run in verbose mode. These parameters were not protected by the no_log feature. An attacker can take advantage of this information to steal those credentials, provided when they have access to the log files containing them. The highest threat from this vulnerability is to data confidentiality. This flaw affects Red Hat Ansible Automation Platform in versions before 1.2.2 and Ansible Tower in versions before 3.8.2.
A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged
Debian
CVE-2021-3447: ansible - A flaw was found in several ansible modules, where parameters containing credent...
vendor_debian·2021·CVSS 5.5
CVE-2021-3447 [MEDIUM] CVE-2021-3447: ansible - A flaw was found in several ansible modules, where parameters containing credent...
A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged in plain-text on managed nodes, as well as being made visible on the controller node when run in verbose mode. These parameters were not protected by the no_log feature. An attacker can take advantage of this information to steal those credentials, provided when they have access to the log files containing them. The highest threat from this vulnerability is to data confidentiality. This flaw affects Red Hat Ansible Automation Platform in versions before 1.2.2 and Ansible Tower in versions before 3.8.2.
Scope: local
bookworm: resolved (fixed in 2.10.7+merged+base+2.10.8+dfsg-1)
bullseye: resolved (fixed in 2.10.7+merged+base+2.10.8+dfsg-1)
forky: resolved (fixed in 2.10.7
GHSA
GHSA-29hx-hv84-8wcq: A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged in plain-text on managed node
ghsa_unreviewed·2022-05-24
CVE-2021-3447 CWE-532 GHSA-29hx-hv84-8wcq: A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged in plain-text on managed node
A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged in plain-text on managed nodes, as well as being made visible on the controller node when run in verbose mode. These parameters were not protected by the no_log feature. An attacker can take advantage of this information to steal those credentials, provided when they have access to the log files containing them. The highest threat from this vulnerability is to data confidentiality. This flaw affects Red Hat Ansible Automation Platform in versions before 1.2.2 and Ansible Tower in versions before 3.8.2.
OSV
CVE-2021-3447: A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged in plain-text on managed node
osv·2021-04-01·CVSS 5.5
CVE-2021-3447 [MEDIUM] CVE-2021-3447: A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged in plain-text on managed node
A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged in plain-text on managed nodes, as well as being made visible on the controller node when run in verbose mode. These parameters were not protected by the no_log feature. An attacker can take advantage of this information to steal those credentials, provided when they have access to the log files containing them. The highest threat from this vulnerability is to data confidentiality. This flaw affects Red Hat Ansible Automation Platform in versions before 1.2.2 and Ansible Tower in versions before 3.8.2.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://bugzilla.redhat.com/show_bug.cgi?id=1939349https://lists.debian.org/debian-lts-announce/2023/12/msg00018.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MS4VPUYVLGSAKOX26IT52BSMEZRZ3KS/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JBZ75MAMVQVZROPYHMRDQKPPVASP63DG/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RUTGO4RS4ZXZSPBU2CHVPT75IAFVTTL3/https://bugzilla.redhat.com/show_bug.cgi?id=1939349https://lists.debian.org/debian-lts-announce/2023/12/msg00018.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MS4VPUYVLGSAKOX26IT52BSMEZRZ3KS/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JBZ75MAMVQVZROPYHMRDQKPPVASP63DG/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RUTGO4RS4ZXZSPBU2CHVPT75IAFVTTL3/
2021-04-01
Published