CVE-2021-20191: Medium severity oracle virtualization vulnerability
A few different modules leak sensitive data such as secret values. This could lead in disclosing those credentials for every user which has access to the output of playbook execution.
Other sources
A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by nolog feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest threat from this vulnerability is to data confidentiality.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-20191?
CVE-2021-20191 is a vulnerability in Ansible that allows credentials, such as secrets, to be disclosed in the console log.
How can an attacker exploit CVE-2021-20191?
An attacker can take advantage of CVE-2021-20191 to steal credentials by accessing the disclosed information in the console log.
What is the severity of CVE-2021-20191?
CVE-2021-20191 has a severity rating of 5.5 (Medium).
Which software versions are affected by CVE-2021-20191?
Ansible versions 2.10.0 to 2.10.7, 2.8.19, and 2.9.0 to 2.9.18 are affected by CVE-2021-20191.
How can I fix CVE-2021-20191?
To fix CVE-2021-20191, you should update Ansible to version 2.10.7, 2.8.19, or 2.9.18, depending on your current version.