PYSEC-2022-164

🗓️ 03 Mar 2022 19:15:00Reported by Python Packaging AdvisoryType

pypa🔗 github.com👁 5 Views

Flaw in Ansible Engine ansible-connection discloses credentials in tracebacks, breaches confidentiality.

Reporter	Title	Published	Views	Family All 86
FreeBSD	Ansible -- Ansible user credentials disclosure in ansible-connection module	25 Jun 202100:00	–	freebsd
AstraLinux	Astra Linux – Vulnerability in Ansible	19 Jun 202611:10	–	astralinux
BDU FSTEC	The vulnerability of the ansible-connection module in the Ansible Configuration Management system, related to the disclosure of information in error messages, allows a perpetrator to gain access to confidential data.	13 Sep 202400:00	–	bdu_fstec
CBLMariner	CVE-2021-3620 affecting package ansible 2.9.23-2	26 May 202219:04	–	cbl_mariner
Tenable Nessus	CentOS 9 : ansible-core-2.14.2-4.el9	29 Feb 202400:00	–	nessus
Tenable Nessus	FreeBSD : Ansible -- Ansible user credentials disclosure in ansible-connection module (9a8514f3-2ab8-11ec-b3a1-8c164582fbac)	13 Oct 202100:00	–	nessus
Tenable Nessus	RHEL 7 / 8 : Ansible security update (2.9.27) (Important) (RHSA-2021:3871)	15 Oct 202100:00	–	nessus
Tenable Nessus	RHEL 7 / 8 : Ansible security update (2.9.27) (Important) (RHSA-2021:3872)	15 Oct 202100:00	–	nessus
Tenable Nessus	RHEL 8 : Red Hat Ansible Automation Platform 2.0.1 Security and Bug fix Release (Important) (RHSA-2021:3874)	28 Apr 202400:00	–	nessus
Tenable Nessus	RHEL 8 : RHV Engine and Host Common Packages security update [ovirt-4.4.9] (Important) (RHSA-2021:4703)	18 Nov 202100:00	–	nessus

Vulners

Node

ansible ansibleRange0–2.9.27

Source	Link
github	www.github.com/ansible/ansible/commit/fe28767970c8ec62aabe493c46b53a5de1e5fac0
github	www.github.com/ansible/ansible/blob/stable-2.9/changelogs/CHANGELOG-v2.9.rst
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/advisories/GHSA-4r65-35qq-ch8j

15 Mar 2022 14:28Current

6.3Medium risk

Vulners AI Score6.3

CVSS 22.1

CVSS 3.15.5

EPSS0.00384

SSVC