CVEvulnerability

CVE-2021-20191

5.5 MEDIUM Published 2021-05-26 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-05-26
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.5 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
2.1 LOW — AV:L/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-532

Description

A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest threat from this vulnerability is to data confidentiality. Versions before ansible 2.9.18 are affected.

Affected configurations

• oracle virtualization 4.0 • redhat ansible (< 2.8.19) • redhat ansible (>= 2.9.0 < 2.9.18) • redhat ansible (>= 2.10.0 < 2.10.7) • redhat ansible tower 3.0 • redhat cisco nx-os collection (< 1.4.0) • redhat community general collection (< 1.3.6) • redhat community general collection (>= 2.0.0 < 2.0.1) • redhat community network collection (< 1.3.2) • redhat community network collection (>= 2.0.0 < 2.0.1) • redhat docker community collection (< 1.2.2) • redhat google cloud platform ansible collection 1.0.2

Related

Weakness · CWE (1)

  • CWE-532 Insertion of Sensitive Information into Log File weakness

References