CVE-2021-3620
published 2022-03-03CVE-2021-3620: A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the…
PriorityP423medium5.5CVSS 3.1
AVLACLPRLUINSUCHINAN
EPSS
0.38%
30.7th percentile
A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality.
Affected
23 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | ansible | < ansible 5.4.0-1 (bookworm) | ansible 5.4.0-1 (bookworm) |
| debian | ansible-core | < ansible 5.4.0-1 (bookworm) | ansible 5.4.0-1 (bookworm) |
| msrc | cm1_ansible_2.9.27-1_on_cbl_mariner_1.0 | — | — |
| redhat | ansible | >= 0 < 2.10.7+merged+base+2.10.17+dfsg-0+deb11u1 | 2.10.7+merged+base+2.10.17+dfsg-0+deb11u1 |
| redhat | ansible | >= 0 < 5.4.0-1 | 5.4.0-1 |
| redhat | ansible | >= 0 < 5.4.0-1 | 5.4.0-1 |
| redhat | ansible | >= 0 < 5.4.0-1 | 5.4.0-1 |
| redhat | ansible | >= 0 < 2.9.27 | 2.9.27 |
| redhat | ansible | >= 0 < 2.0.0.2-2ubuntu1.3+esm1 | 2.0.0.2-2ubuntu1.3+esm1 |
| redhat | ansible | >= 0 < 2.5.1+dfsg-1ubuntu0.1+esm1 | 2.5.1+dfsg-1ubuntu0.1+esm1 |
| redhat | ansible | >= 0 < 2.9.6+dfsg-1ubuntu0.1~esm1 | 2.9.6+dfsg-1ubuntu0.1~esm1 |
| redhat | ansible | >= 0 < 2.10.7+merged+base+2.10.8+dfsg-1ubuntu0.1~esm1 | 2.10.7+merged+base+2.10.8+dfsg-1ubuntu0.1~esm1 |
| redhat | ansible_automation_platform_early_access | — | — |
| redhat | ansible_automation_platform_early_access | — | — |
| redhat | ansible_engine | < 2.9.27 | 2.9.27 |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux_for_power_little_endian | — | — |
| redhat | openstack | — | — |
| redhat | openstack | — | — |
| redhat | virtualization | — | — |
| redhat | virtualization_for_ibm_power_little_endian | — | — |
| redhat | virtualization_host | — | — |
| redhat | virtualization_manager | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:P/I:N/A:N
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_msrc5.5MEDIUM
vendor_redhat5.5MEDIUM
vendor_ubuntu5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
ansible vulnerabilities
osv·2022-06-07·CVSS 5.0
CVE-2020-1733 [MEDIUM] ansible vulnerabilities
ansible vulnerabilities
It was discovered that Ansible did not properly manage directory
permissions when running playbooks with an unprivileged become user. A
local attacker could possibly use this issue to cause a race condition,
escalate privileges and execute arbitrary code. This issue only affected
Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-1733)
It was discovered that the fix to address CVE-2020-1733 in Ansible was
incomplete on systems using ACLs and FUSE filesystems. A local attacker
could possibly use this issue to cause a race condition, escalate
privileges and execute arbitrary code. This issue only affected
Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-10744)
It was discovered that Ansible did not properly manage multi-line YAML
s
OSV
Ansible discloses sensitive information in traceback error message
osv·2022-03-04
CVE-2021-3620 [MEDIUM] Ansible discloses sensitive information in traceback error message
Ansible discloses sensitive information in traceback error message
Ansible is an IT automation system that handles configuration management, application deployment, cloud provisioning, ad-hoc task execution, network automation, and multi-node orchestration. A flaw was found in Ansible Engine's ansible-connection module where sensitive information, such as the Ansible user credentials, is disclosed by default in the traceback error message when Ansible receives an unexpected response from `set_options`. The highest threat from this vulnerability is confidentiality.
GHSA
Ansible discloses sensitive information in traceback error message
ghsa·2022-03-04
CVE-2021-3620 [MEDIUM] CWE-209 Ansible discloses sensitive information in traceback error message
Ansible discloses sensitive information in traceback error message
Ansible is an IT automation system that handles configuration management, application deployment, cloud provisioning, ad-hoc task execution, network automation, and multi-node orchestration. A flaw was found in Ansible Engine's ansible-connection module where sensitive information, such as the Ansible user credentials, is disclosed by default in the traceback error message when Ansible receives an unexpected response from `set_options`. The highest threat from this vulnerability is confidentiality.
OSV
CVE-2021-3620: A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by defau
osv·2022-03-03·CVSS 5.5
CVE-2021-3620 [MEDIUM] CVE-2021-3620: A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by defau
A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality.
Ubuntu
Ansible vulnerabilities
vendor_ubuntu·2022-06-07·CVSS 5.0
CVE-2020-10744 [MEDIUM] Ansible vulnerabilities
Title: Ansible vulnerabilities
Summary: Several security issues were fixed in Ansible.
It was discovered that Ansible did not properly manage directory
permissions when running playbooks with an unprivileged become user. A
local attacker could possibly use this issue to cause a race condition,
escalate privileges and execute arbitrary code. This issue only affected
Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-1733)
It was discovered that the fix to address CVE-2020-1733 in Ansible was
incomplete on systems using ACLs and FUSE filesystems. A local attacker
could possibly use this issue to cause a race condition, escalate
privileges and execute arbitrary code. This issue only affected
Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-10744)
It was d
Microsoft
A flaw was found in Ansible Engine's ansible-connection module where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest thre
vendor_msrc·2022-03-08·CVSS 5.5
CVE-2021-3620 [MEDIUM] CWE-209 A flaw was found in Ansible Engine's ansible-connection module where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest thre
A flaw was found in Ansible Engine's ansible-connection module where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to addi
Red Hat
Ansible: ansible-connection module discloses sensitive info in traceback error message
vendor_redhat·2021-06-25·CVSS 5.5
CVE-2021-3620 [MEDIUM] CWE-209 Ansible: ansible-connection module discloses sensitive info in traceback error message
Ansible: ansible-connection module discloses sensitive info in traceback error message
A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality.
A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality.
Statement: Red Hat Gluster Storage 3 no longer maintains its own version of Ansible. The prerequisite is to enable the Ansible repository in order to consume the latest version of Ansible, which has many bug
Debian
CVE-2021-3620: ansible - A flaw was found in Ansible Engine's ansible-connection module, where sensitive ...
vendor_debian·2021·CVSS 5.5
CVE-2021-3620 [MEDIUM] CVE-2021-3620: ansible - A flaw was found in Ansible Engine's ansible-connection module, where sensitive ...
A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality.
Scope: local
bookworm: resolved (fixed in 5.4.0-1)
bullseye: resolved (fixed in 2.10.7+merged+base+2.10.17+dfsg-0+deb11u1)
forky: resolved (fixed in 5.4.0-1)
sid: resolved (fixed in 5.4.0-1)
trixie: resolved (fixed in 5.4.0-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://bugzilla.redhat.com/show_bug.cgi?id=1975767https://github.com/ansible/ansible/blob/stable-2.9/changelogs/CHANGELOG-v2.9.rst#security-fixeshttps://github.com/ansible/ansible/commit/fe28767970c8ec62aabe493c46b53a5de1e5fac0https://lists.debian.org/debian-lts-announce/2023/12/msg00018.htmlhttps://bugzilla.redhat.com/show_bug.cgi?id=1975767https://github.com/ansible/ansible/blob/stable-2.9/changelogs/CHANGELOG-v2.9.rst#security-fixeshttps://github.com/ansible/ansible/commit/fe28767970c8ec62aabe493c46b53a5de1e5fac0https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html
2022-03-03
Published