Ansible: ansible-connection module discloses sensitive info in traceback error message

🗓️ 14 Oct 2021 19:43:29Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 8 Views

A flaw in Ansible Engine's ansible-connection module reveals credentials in traceback errors.

Reporter	Title	Published	Views	Family All 84
FreeBSD	Ansible -- Ansible user credentials disclosure in ansible-connection module	25 Jun 202100:00	–	freebsd
AstraLinux	Astra Linux – Vulnerability in Ansible	20 May 202605:53	–	astralinux
BDU FSTEC	The vulnerability of the ansible-connection module in the Ansible Configuration Management system, related to the disclosure of information in error messages, allows a perpetrator to gain access to confidential data.	13 Sep 202400:00	–	bdu_fstec
CBLMariner	CVE-2021-3620 affecting package ansible 2.9.23-2	26 May 202219:04	–	cbl_mariner
Tenable Nessus	CentOS 9 : ansible-core-2.14.2-4.el9	29 Feb 202400:00	–	nessus
Tenable Nessus	FreeBSD : Ansible -- Ansible user credentials disclosure in ansible-connection module (9a8514f3-2ab8-11ec-b3a1-8c164582fbac)	13 Oct 202100:00	–	nessus
Tenable Nessus	RHEL 7 / 8 : Ansible security update (2.9.27) (Important) (RHSA-2021:3871)	15 Oct 202100:00	–	nessus
Tenable Nessus	RHEL 7 / 8 : Ansible security update (2.9.27) (Important) (RHSA-2021:3872)	15 Oct 202100:00	–	nessus
Tenable Nessus	RHEL 8 : Red Hat Ansible Automation Platform 2.0.1 Security and Bug fix Release (Important) (RHSA-2021:3874)	28 Apr 202400:00	–	nessus
Tenable Nessus	RHEL 8 : RHV Engine and Host Common Packages security update [ovirt-4.4.9] (Important) (RHSA-2021:4703)	18 Nov 202100:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	7	noarch	ansible	2.9.27-1.el7ae	ansible-2.9.27-1.el7ae.noarch.rpm
Red Hat Enterprise Linux	8	noarch	ansible	2.9.27-1.el8ae	ansible-2.9.27-1.el8ae.noarch.rpm
Red Hat Enterprise Linux	7	noarch	ansible-test	2.9.27-1.el7ae	ansible-test-2.9.27-1.el7ae.noarch.rpm
Red Hat Enterprise Linux	8	noarch	ansible-test	2.9.27-1.el8ae	ansible-test-2.9.27-1.el8ae.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2021-3620
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-3620
cve	www.cve.org/CVERecord

27 Jan 2026 10:42Current

6.8Medium risk

Vulners AI Score6.8

CVSS 22.1

CVSS 3.15.5

EPSS0.00384

SSVC

Ansible Engine ansible-connection module sensitive information disclosure traceback error message credential exposure