CVE-2021-20178: Medium severity redhat ansible vulnerability
A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucketpipelinevariable module. This flaw allows an attacker to steal bitbucketpipeline credentials. The highest threat from this vulnerability is to confidentiality.
Other sources
A flaw was found in ansible. The 'authkey' and 'privkey' credentials are disclosed by default and not protected by nolog feature when using the snmpfacts module. Attackers could take advantage of this information to steal the SNMP credentials. The highest threat from this vulnerability is to data confidentiality.
snmpfacts module in Ansible leaks user authentication such as authKey and privKey. This could lead in disclosing those credentials for every user which has access to the output of playbook execution.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/ansibleto a version that resolves this vulnerability.Fixed in 0:2.9.18-1.el7ae - Upgrade
Upgrade
redhat/ansibleto a version that resolves this vulnerability.Fixed in 0:2.9.18-1.el8ae - Upgrade
Upgrade
pip/ansibleto a version that resolves this vulnerability.Fixed in 2.9.18 - Upgrade
Upgrade
redhat/ansibleto a version that resolves this vulnerability.Fixed in 2.9.18 - Configuration
Enable no_log for bitbucket_pipeline_variable module invocations to prevent bitbucket_pipeline credentials from being printed to the console output.
ansible module bitbucket_pipeline_variable no_log = true - Configuration
Enable no_log for snmp_facts module invocations to prevent authKey and privKey from being disclosed in playbook output.
ansible module snmp_facts no_log = true - Compensating control
Restrict access to playbook execution logs and console output to trusted users/systems (limit who can view playbook output) to reduce exposure of credentials until fixes are applied.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID of this flaw in Ansible?
The vulnerability ID is CVE-2021-20178.
What is the severity level of CVE-2021-20178?
The severity level of CVE-2021-20178 is medium.
Which software is affected by this vulnerability?
The affected software includes Ansible, Ansible Tower, and Fedora.
How can an attacker exploit the CVE-2021-20178 vulnerability?
An attacker can exploit this vulnerability to steal bitbucket_pipeline credentials.
How can I fix the CVE-2021-20178 vulnerability in Ansible?
To fix this vulnerability, update Ansible to version 2.9.18.