A flaw was found in the Ansible Engine 2.9.18 where sensitive info is not masked by default and is not protected by the no_log feature when using the sub-option feature of the basic.py module. This flaw allows an attacker to obtain sensitive information. The highest threat from this vulnerability is to confidentiality.

🗓️ 18 Oct 2021 07:00:00Reported by MicrosoftType

Ansible Engine 2.9.18 flaw exposes sensitive data via the basic.py sub-option; not masked by default or no log.

Reporter	Title	Published	Views	Family All 91
IBM Security Bulletins	Security Bulletin: Ansible vulnerability affects IBM Elastic Storage System (CVE-2021-20228)	24 May 202112:08	–	ibm
ArchLinux	[ASA-202102-30] ansible-base: information disclosure	20 Feb 202100:00	–	archlinux
AstraLinux	Astra Linux – Vulnerability in Ansible	3 May 202623:59	–	astralinux
BDU FSTEC	The vulnerability of the Ansible configuration management system, related to the exposure of information, allows attackers to gain access to confidential data.	20 Jul 202100:00	–	bdu_fstec
CBLMariner	CVE-2021-20228 affecting package ansible 2.9.18-1	22 Oct 202104:51	–	cbl_mariner
CBLMariner	CVE-2021-20228 affecting package ansible for versions less than 2.12.1-1	9 Apr 202206:51	–	cbl_mariner
CNNVD	Red Hat Ansible Information Disclosure Vulnerability	19 Feb 202100:00	–	cnnvd
CVE	CVE-2021-20228	29 Apr 202115:34	–	cve
Cvelist	CVE-2021-20228	29 Apr 202115:34	–	cvelist
Debian	[SECURITY] [DSA 4950-1] ansible security update	7 Aug 202109:26	–	debian