PT-2021-8091 · Unknown+6 · Ansible Engine+6
Dalrrard
·
Published
2021-06-24
·
Updated
2025-05-04
·
CVE-2021-3620
CVSS v4.0
6.8
Medium
| Vector | AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Ansible Engine versions prior to 2.8.15
Description
A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality.
Recommendations
For versions prior to 2.8.15, update to a version that contains a fix for this issue, such as version 2.8.16 or later, to prevent sensitive information disclosure. As a temporary workaround, consider disabling the
ansible-connection module until a patch is available. Restrict access to the set options function to minimize the risk of exploitation. Avoid using the set options function in the affected ansible-connection module until the issue is resolved.Fix
DoS
Generation of Error Message Containing Sensitive Information
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Ansible Engine
Astra Linux
Linuxmint
Red Os
Suse
Ubuntu