Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2021-20191

Опубликовано: 15 янв. 2021
Источник: redhat
CVSS3: 5
EPSS Низкий

Описание

A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest threat from this vulnerability is to data confidentiality. Versions before ansible 2.9.18 are affected.

A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest threat from this vulnerability is to data confidentiality.

Отчет

The version of ansible shipped with Red Hat Gluster Storage (RHGS) 3 includes the vulnerable network/nxos/nxos_* modules. However, RHGS 3 no longer maintains its own version of Ansible, prerequisite is to enable ansible repository in order to consume the latest version of ansible which has many bug and security fixes.

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
Red Hat Ansible Tower 3ansibleOut of support scope
Red Hat Storage 3ansibleWill not fix
Red Hat Ansible Automation Platform 1.2 for RHEL 7ansible-automation-platform/platform-resource-operator-bundleFixedRHSA-2021:107909.04.2021
Red Hat Ansible Automation Platform 1.2 for RHEL 7ansible-automation-platform/platform-resource-rhel7-operatorFixedRHSA-2021:107909.04.2021
Red Hat Ansible Automation Platform 1.2 for RHEL 7ansible-automation-platform/platform-resource-runner-rhel7FixedRHSA-2021:107909.04.2021
Red Hat Ansible Engine 2.9 for RHEL 7ansibleFixedRHSA-2021:066424.02.2021
Red Hat Ansible Engine 2.9 for RHEL 8ansibleFixedRHSA-2021:066424.02.2021
Red Hat Ansible Engine 2 for RHEL 7ansibleFixedRHSA-2021:066324.02.2021
Red Hat Ansible Engine 2 for RHEL 8ansibleFixedRHSA-2021:066324.02.2021
Red Hat Virtualization 4 for Red Hat Enterprise Linux 8ansibleFixedRHSA-2021:218001.06.2021

Показывать по

Дополнительная информация

Статус:

Moderate
Дефект:
CWE-532
https://bugzilla.redhat.com/show_bug.cgi?id=1916813ansible: multiple modules expose secured values

EPSS

Процентиль: 11%
0.00037
Низкий

5 Medium

CVSS3

Связанные уязвимости

CVSS3: 5.5
ubuntu
больше 4 лет назад

A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest threat from this vulnerability is to data confidentiality. Versions before ansible 2.9.18 are affected.

CVSS3: 5.5
nvd
больше 4 лет назад

A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest threat from this vulnerability is to data confidentiality. Versions before ansible 2.9.18 are affected.

CVSS3: 5.5
msrc
больше 4 лет назад

A flaw was found in ansible. Credentials such as secrets are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest threat from this vulnerability is to data confidentiality. Versions before ansible 2.9.18 are affected.

CVSS3: 5.5
debian
больше 4 лет назад

A flaw was found in ansible. Credentials, such as secrets, are being d ...

CVSS3: 5.5
github
больше 4 лет назад

Insertion of Sensitive Information into Log File in ansible

EPSS

Процентиль: 11%
0.00037
Низкий

5 Medium

CVSS3