PYSEC-2021-124: Medium severity Ansible Ansible vulnerability

Q: Who could exploit the disclosed credentials?

An attacker who can access Ansible console logs containing the exposed output could use the disclosed credentials. The primary impact is loss of confidentiality.

Q: Does enabling no_log protect credentials when using the affected modules?

No. The flaw causes credentials to be disclosed in console logs by default and leaves them unprotected by the no_log feature when using the affected modules.

Q: Which Ansible versions are affected?

Versions before Ansible 2.9.18 are affected.

Published May 26, 2021

Updated

A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by nolog feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest threat from this vulnerability is to data confidentiality. Versions before ansible 2.9.18 are affected.

Affected Software

1 affected component

Ansible Ansible<2.9.18

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ansible to a version that resolves this vulnerability.
Fixed in 2.9.18

Event History

May 26, 2021

CVE Published

via OSV·09:15 PM

Data Sourced

via OSV·09:15 PM

DescriptionSeverity

Frequently Asked Questions

Who could exploit the disclosed credentials?

An attacker who can access Ansible console logs containing the exposed output could use the disclosed credentials. The primary impact is loss of confidentiality.

Does enabling no_log protect credentials when using the affected modules?

No. The flaw causes credentials to be disclosed in console logs by default and leaves them unprotected by the no_log feature when using the affected modules.

Which Ansible versions are affected?

Versions before Ansible 2.9.18 are affected.

PYSEC-2021-124: Medium severity Ansible Ansible vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who could exploit the disclosed credentials?

Does enabling no_log protect credentials when using the affected modules?

Which Ansible versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who could exploit the disclosed credentials?

Does enabling no_log protect credentials when using the affected modules?

Which Ansible versions are affected?