Login Request a demo
Medium severity · published May 26, 2021
CVE-2021-20191
A flaw was found in ansible
5.5
CVSS
0.3%
EPSS
No
On KEV
Description
A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest threat from this vulnerability is to data confidentiality. Versions before ansible 2.9.18 are affected.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AN
Ansible · Redhat
before 2.8.19; 2.9.0 before 2.9.18; 2.10.0 before 2.10.7 · source: NVD
AT
Ansible Tower · Redhat
3.0 · source: NVD
CN
Cisco Nx-os Collection · Redhat
before 1.4.0 · source: NVD
CG
Community General Collection · Redhat
before 1.3.6; 2.0.0 before 2.0.1 · source: NVD
CN
Community Network Collection · Redhat
before 1.3.2; 2.0.0 before 2.0.1 · source: NVD
DC
Docker Community Collection · Redhat
before 1.2.2 · source: NVD
GC
Google Cloud Platform Ansible Collection · Redhat
1.0.2 · source: NVD
VI
Virtualization · Oracle
4.0 · source: NVD
Affected product
VI
Virtualization
Oracle
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-20191
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-20191
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1916813
lists.debian.org
https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html
More from Virtualization
5.3
CVE-2020-10775
An Open redirect vulnerability was found in ovirt-engine versions 4.4 and earlier, where it allows remote attackers to redirect users to arbitrary web sites and attempt phishing…
–
CVE-2015-2581
Unspecified vulnerability in the Oracle Secure Global Desktop component in Oracle Virtualization 5.1 and 5.2 allows remote attackers to affect confidentiality and availability via…
–
CVE-2014-0230
Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle cases where an HTTP response occurs before finishing the reading of an entire…
–
CVE-2014-6459
Unspecified vulnerability in the Oracle Secure Global Desktop component in Oracle Virtualization 5.0 and 5.1 allows remote attackers to affect availability via vectors related to…
–
CVE-2014-2476
Unspecified vulnerability in the Oracle Secure Global Desktop component in Oracle Virtualization 5.0 and 5.1 allows remote attackers to affect availability via vectors related to…