GitHub Advisoryadvisory · PyPI

GHSA-4r65-35qq-ch8j Ansible discloses sensitive information in traceback error message

MEDIUM Published 2022-03-04 Modified 2024-09-09 Official page ↗
Aliases
CVE-2021-3620
Ecosystem
PyPI
Packages
ansible
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-209
Reviewed
2022-03-24

Affected packages

• PyPI ansible: < 2.9.27 → fixed in 2.9.27

Description

Ansible is an IT automation system that handles configuration management, application deployment, cloud provisioning, ad-hoc task execution, network automation, and multi-node orchestration. A flaw was found in Ansible Engine's ansible-connection module where sensitive information, such as the Ansible user credentials, is disclosed by default in the traceback error message when Ansible receives an unexpected response from `set_options`. The highest threat from this vulnerability is confidentiality.

Related

Alias · CVE (1)

  • CVE-2021-3620 A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is… vulnerability

Weakness · CWE (1)

  • CWE-209 Generation of Error Message Containing Sensitive Information weakness

References