PT-2021-3601 · Red Hat+3 · Ansible Engine+3
Jborean93
·
Published
2021-03-12
·
Updated
2026-06-03
·
CVE-2021-20228
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Ansible Engine versions prior to 2.10.6rc1
Ansible Engine versions prior to 2.9.18rc1
Ansible Engine versions prior to 2.8.19rc1
Description
A flaw was found in the Ansible Engine, where sensitive information is not masked by default and is not protected by the
no log feature when using the sub-option feature of the basic.py module. This allows an attacker to obtain sensitive information, with the highest threat being to confidentiality.Recommendations
For Ansible Engine versions prior to 2.10.6rc1, update to version 2.10.6rc1 or later.
For Ansible Engine versions prior to 2.9.18rc1, update to version 2.9.18rc1 or later.
For Ansible Engine versions prior to 2.8.19rc1, update to version 2.8.19rc1 or later.
As a temporary workaround, consider disabling the sub-option feature of the basic.py module until a patch is available. Restrict access to sensitive information to minimize the risk of exploitation.
Fix
Information Disclosure
Insufficiently Protected Credentials
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Ansible Engine
Astra Linux
Suse