Debian Ansible vulnerabilities

CVE-2021-20180 [MEDIUM] CVE-2021-20180: ansible - A flaw was found in ansible module where credentials are disclosed in the consol... A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucket_pipeline_variable module. This flaw allows an attacker to steal bitbucket_pipeline credentials. The highest threat from this vulnerability is to confidentiality. Scope: local bookworm: resolved (fixed i

CVE-2024-8775 [MEDIUM] CVE-2024-8775: ansible - A flaw was found in Ansible, where sensitive information stored in Ansible Vault... A flaw was found in Ansible, where sensitive information stored in Ansible Vault files can be exposed in plaintext during the execution of a playbook. This occurs when using tasks such as include_vars to load vaulted variables without setting the no_log: true parameter, resulting in sensitive data being printed in the playbook output or logs. This can lead to the un

CVE-2025-14010 [MEDIUM] CVE-2025-14010: ansible - A flaw was found in ansible-collection-community-general. This vulnerability all... A flaw was found in ansible-collection-community-general. This vulnerability allows for information exposure (IE) of sensitive credentials, specifically plaintext passwords, via verbose output when running Ansible with debug modes. Attackers with access to logs could retrieve these secrets and potentially compromise Keycloak accounts or administrative access. Scop

CVE-2020-1753 [MEDIUM] CVE-2020-1753: ansible - A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to... A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prior to 2.8.11 and all Ansible 2.9.x versions prior to 2.9.7, when managing kubernetes using the k8s module. Sensitive parameters such as passwords and tokens are passed to kubectl from the command line, not using an environment variable or an input c

CVE-2020-10685 [MEDIUM] CVE-2020-10685: ansible - A flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x befor... A flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when using modules which decrypts vault files such as assemble, script, unarchive, win_copy, aws_s3 or copy modules. The temporary directory is creat

CVE-2021-3447 [MEDIUM] CVE-2021-3447: ansible - A flaw was found in several ansible modules, where parameters containing credent... A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged in plain-text on managed nodes, as well as being made visible on the controller node when run in verbose mode. These parameters were not protected by the no_log feature. An attacker can take advantage of this information to steal those credentials

CVE-2020-10729 [MEDIUM] CVE-2020-10729: ansible - A flaw was found in the use of insufficiently random values in Ansible. Two rand... A flaw was found in the use of insufficiently random values in Ansible. Two random password lookups of the same length generate the equal value as the template caching action for the same file since no re-evaluation happens. The highest threat from this vulnerability would be that all passwords are exposed at once for the file. This flaw affects Ansible Engine ver

CVE-2020-14332 [MEDIUM] CVE-2020-14332: ansible - A flaw was found in the Ansible Engine when using module_args. Tasks executed wi... A flaw was found in the Ansible Engine when using module_args. Tasks executed with check mode (--check-mode) do not properly neutralize sensitive data exposed in the event data. This flaw allows unauthorized users to read this data. The highest threat from this vulnerability is to confidentiality. Scope: local bookworm: resolved (fixed in 2.9.13+dfsg-1) bullseye:

CVE-2020-14330 [MEDIUM] CVE-2020-14330: ansible - An Improper Output Neutralization for Logs flaw was found in Ansible when using ... An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content and json output. This flaw allows an attacker to access the logs or outputs of performed tasks to read keys used in playbooks from other users within the uri module. The highest threat from this vulnerability is to data confide

CVE-2019-14858 [MEDIUM] CVE-2019-14858: ansible - A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x ... A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. When a module has an argument_spec with sub parameters marked as no_log, passing an invalid parameter name to the module will cause the task to fail before the no_log options in the sub parameters are processed. As a result, data in the sub parameter fields will not be maske

CVE-2016-8647 [MEDIUM] CVE-2016-8647: ansible - An input validation vulnerability was found in Ansible's mysql_user module befor... An input validation vulnerability was found in Ansible's mysql_user module before 2.2.1.0, which may fail to correctly change a password in certain circumstances. Thus the previous password would still be active when it should have been changed. Scope: local bookworm: resolved (fixed in 2.2.0.0-4) bullseye: resolved (fixed in 2.2.0.0-4) forky: resolved (fixed in 2.2

CVE-2021-3620 [MEDIUM] CVE-2021-3620: ansible - A flaw was found in Ansible Engine's ansible-connection module, where sensitive ... A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality. Scope: local bookworm: resolved (fixed in 5.4.0-1) bullseye: resolved (fixed in 2.10.7+merged+base+2.10.17+dfsg-0+deb

CVE-2020-1746 [MEDIUM] CVE-2020-1746: ansible - A flaw was found in the Ansible Engine affecting Ansible Engine versions 2.7.x b... A flaw was found in the Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when the ldap_attr and ldap_entry community modules are used. The issue discloses the LDAP bind password to stdout or a log file if a playbook task

CVE-2024-0690 [MEDIUM] CVE-2024-0690: ansible - An information disclosure flaw was found in ansible-core due to a failure to res... An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG configuration in some scenarios. Information is still included in the output in certain tasks, such as loop items. Depending on the task, this issue may include sensitive information, such as decrypted secret values. Scope: local bookworm: resolved (fixed in 5.4.0

CVE-2014-4660 [MEDIUM] CVE-2014-4660: ansible - Ansible before 1.5.5 constructs filenames containing user and password fields on... Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by leveraging existence of a file that uses the "deb http://user:pass@server:port/" format. Scope: local bookworm: resolved (fixed in 1.5.5+dfs

CVE-2020-10691 [MEDIUM] CVE-2020-10691: ansible - An archive traversal flaw was found in all ansible-engine versions 2.9.x prior t... An archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running ansible-galaxy collection install. When extracting a collection .tar.gz file, the directory is created without sanitizing the filename. An attacker could take advantage to overwrite any file within the system. Scope: local bookworm: resolved (fixed in 2.9.7+dfsg-1

CVE-2020-1733 [MEDIUM] CVE-2020-1733: ansible - A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and pr... A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a playbook with an unprivileged become user. When Ansible needs to run a module with become user, the temporary directory is created in /var/tmp. This directory is created with "umask 77 && mkdir -p "; this operation does not fail if the directory alread

CVE-2020-10744 [MEDIUM] CVE-2020-10744: ansible - An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insec... An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running become_user from become directive. The provided fix is insufficient to prevent the race condition on systems using ACLs and FUSE filesystems. Ansible Engine 2.7.18, 2.8.12, and 2.9.9 as well as previous versions are affected and Ansible Tower 3.4.5,

CVE-2015-3908 [MEDIUM] CVE-2015-3908: ansible - Ansible before 1.9.2 does not verify that the server hostname matches a domain n... Ansible before 1.9.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. Scope: local bookworm: resolved (fixed in 1.9.2+dfsg-1) bullseye: resolved (fixed in 1.9.2+dfsg-1) for

CVE-2020-1740 [LOW] CVE-2020-1740: ansible - A flaw was found in Ansible Engine when using Ansible Vault for editing encrypte... A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files. When a user executes "ansible-vault edit", another user on the same computer can read the old and new secret, as it is created in a temporary file with mkstemp and the returned file descriptor is closed and the method write_data is called to write the existing secret in the file. T