Medium severity · published Mar 3, 2022
CVE-2021-3620
A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error…
5.5
CVSS
0.4%
EPSS
No
On KEV
Description
A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AA
Ansible Automation Platform Early Access · Redhat
2.0 · source: NVD
AE
Ansible Engine · Redhat
before 2.9.27 · source: NVD
EL
Enterprise Linux · Redhat
8.0 · source: NVD
EL
Enterprise Linux For Power Little Endian · Redhat
8.0 · source: NVD
OP
Openstack · Redhat
1; 16.1 · source: NVD
VI
Virtualization · Redhat
4.0 · source: NVD
VF
Virtualization For Ibm Power Little Endian · Redhat
4.0 · source: NVD
VH
Virtualization Host · Redhat
4.0 · source: NVD
VM
Virtualization Manager · Redhat
4.4 · source: NVD
Affected product
AA
Ansible Automation Platform Early Access
Redhat
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-3620
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-3620
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1975767
Release Notes
https://github.com/ansible/ansible/blob/stable-2.9/changelogs/CHANGELOG-v2.9.rst#security-fixes
Patch
https://github.com/ansible/ansible/commit/fe28767970c8ec62aabe493c46b53a5de1e5fac0
lists.debian.org
https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html
More from Ansible Automation Platform Early Access
8.8
CVE-2021-4112
A flaw was found in ansible-tower where the default installation is vulnerable to job isolation escape