PT-2021-8096 · Ansible+3 · Ansible+4
Borja Tarraso
·
Published
2021-01-17
·
Updated
2025-11-21
·
CVE-2021-20191
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Ansible versions prior to 2.9.18
Description
A flaw was found in Ansible where credentials, such as secrets, are disclosed in the console log by default and not protected by the
no log feature when using certain modules. This allows an attacker to steal those credentials, posing the highest threat to data confidentiality.Recommendations
For versions prior to 2.9.18, update to version 2.9.18 or later to resolve the issue. As a temporary workaround, consider disabling the use of modules that disclose credentials in the console log until a patch is available. Restrict access to the console log to minimize the risk of exploitation. Avoid using sensitive credentials in modules that are not protected by the
no log feature until the issue is resolved.Fix
Insertion into Log File
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Ansible
Ansible-Core
Astra Linux
Suse