CVE-2018-7750

CVE-2018-7750 affects Paramiko’s SSH server transport.py: before fixes, it did not verify that authentication completed before processing other requests (e.g., channel-open), enabling a customized SSH client to bypass authentication. Affected series include 1.17.6 and earlier in 1.x, 1.18.x befor...

CVE-2017-7481

CVE-2017-7481 affects Ansible before versions 2.3.1.0 and 2.4.0.0, where lookup-plugin results could be marked unsafe, allowing code execution via jinja2 if an attacker controls lookup() results. The description and connected advisories confirm the vulnerability originates from unsafe lookup resu...

CVE-2018-16837

CVE-2018-16837 affects Ansible; the User module leaks data passed to ssh-keygen, enabling potential exposure of credentials (e.g., passphrases) visible in a process list for users with access. The connected documents confirm this information disclosure issue and note multiple vendor advisories/pa...

CVE-2018-16876

CVE-2018-16876 affects Ansible prior to versions 2.5.14, 2.6.11, and 2.7.5, exposing information via information disclosure in vvv+ mode when no_log is enabled. The issue is a data leakage vulnerability, confirmed across multiple advisories (e.g., RHSA-2019-0564/0590 and related distributions) an...

CVE-2018-10875

CVE-2018-10875 affects Ansible where ansible.cfg is read from the current working directory, allowing an attacker to influence the plugin/module path and potentially execute arbitrary code. The issue arises because the CWD can be manipulated to point to controlled code. Red Hat/Ubuntu/openSUSE ad...

CVE-2019-14905

The CVE-2019-14905 issue affects Ansible Engine’s nxos_file_copy module, where the filename parameter could be crafted to inject OS commands on NXOS devices. This is a local attack with potential confidentiality, integrity, and availability impacts as described (loss of confidentiality, etc.). Af...

CVE-2018-10855

CVE-2018-10855 affects Ansible: versions 2.5 prior to 2.5.5 and 2.4 prior to 2.4.5 do not honor the no_log flag for failed tasks, which can cause sensitive data passed to a task to be exposed in logs and on the user’s terminal when the task fails. Red Hat advisories (RHSA-2018:1948, RHSA-2019:005...

CVE-2021-3620

CVE-2021-3620 is a disclosure vulnerability in Ansible Engine's ansible-connection module where sensitive information such as the Ansible user credentials is exposed in traceback messages. The issue is documented across multiple sources (IBM Spectrum Fusion HCI bulletin, Debian LTS advisory, and ...

CVE-2019-14846

CVE-2019-14846 affects Ansible Engine where all 2.x lines up to 2.8.5 (and similar older branches) could disclose credentials because plugins logging at DEBUG level log sensitive data. The flaw does not affect Ansible modules (they run in a separate process). Public docs show multiple vendors/adv...

CVE-2019-14858

CVE-2019-14858 affects Ansible engine 2.x up to 2.8 and Ansible Tower 3.x up to 3.5. Root cause: when a module has sub-parameters marked as no_log, an invalid parameter name can cause the task to fail before masking in the sub-parameters is processed, causing data in those fields to be exposed in...

CVE-2020-1737

Consolidated sources confirm CVE-2020-1737 is a path-traversal flaw in Ansible’s win_unzip Extract-Zip handling, affecting Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior. The vulnerability arises because extracted files are not checked against the destination folder, allowing an a...

CVE-2018-16859

CVE-2018-16859 affects Ansible (Windows) where PowerShell ScriptBlock logging and Module logging can expose become passwords in plaintext in Event Logs when running playbooks. A local administrator can read these logs and obtain the plaintext password. The issue was noted for Ansible Engine 2.8 a...

CVE-2020-1746

CVE-2020-1746 affects Ansible Engine components (and Ansible Tower) where LDAP modules ldap_attr/ldap_entry can leak the LDAP bind password to stdout or logs when bind_pw is used. Versions vulnerable: Ansible 2.7.x before 2.7.17, 2.8.x before 2.8.11, 2.9.x before 2.9.7, and corresponding Ansible ...

CVE-2020-14365

CVE-2020-14365 affects the Ansible Engine (ansible-engine 2.8.x before 2.8.15; 2.9.x before 2.9.13). When using the dnf module, GPG signatures are ignored during installation if disable_gpg_check is False, allowing potentially malicious packages to be installed and their installation scripts to e...

CVE-2020-10685

CVE-2020-10685 affects Ansible Engine versions 2.7.x before 2.7.17, 2.8.x before 2.8.11, 2.9.x before 2.9.7, and Ansible Tower up to 3.6.3, when using vault-decrypting modules (assemble, script, unarchive, win_copy, aws_s3, copy). A temporary directory is created in /tmp and left unencrypted; on ...

CVE-2020-1753

Affected software: Ansible Engine via Astra Linux advisory references the same CVE-2020-1753 issue affecting Ansible 2.7.x before 2.7.17, 2.8.x before 2.8.11, and 2.9.x before 2.9.7 when using the k8s module to manage Kubernetes. Vulnerability details: Sensitive parameters (passwords/tokens) are ...

CVE-2020-10691

CVE-2020-10691 affects Ansible Engine: all 2.9.x versions prior to 2.9.7. The vulnerability is an archive traversal in the extraction of a collection .tar.gz during ansible-galaxy collection install, where the target directory is created without sanitizing filenames, allowing an attacker to overw...

CVE-2021-3583

CVE-2021-3583 affects Ansible. A flaw allows template injection via facts used in templates when multi-line YAML strings contain templates, enabling command injection and disclosure of sensitive information. Affected: Ansible controller/template processing. Root cause: improper handling of templa...

CVE-2018-10874

CVE-2018-10874 affects Ansible. The issue arises when inventory variables are loaded from the current working directory during ad-hoc commands, which attackers can control, enabling arbitrary code execution (local attacker could compromise the target via manipulated inventory vars). The NVD entry...

CVE-2020-14330

CVE-2020-14330 (Ansible) is an Improper Output Neutralization for Logs flaw in the uri module that can expose sensitive data in logs/output, including keys from playbooks, affecting confidentiality. The vulnerability affects Ansible Engine/uri usage with local access; no exploit details are provi...

CVE-2021-20228

CVE-2021-20228 affects Ansible Engine 2.9.18 where sensitive info is not masked by default and not protected by no_log when using the basic.py sub-option, impacting confidentiality. Multiple connected advisories confirm the issue and note updates/patches: IBM ESS (fix to 6.0.2.1), Debian security...

CVE-2020-14332

The CVE-2020-14332 issue affects the Ansible Engine (module_args) where tasks run in check mode may reveal sensitive data from event data, impacting confidentiality. Exploitation details are not provided in the documents. Remediation guidance across connected sources indicates applying vendor sec...

CVE-2020-1734

CVE-2020-1734 affects the ansible pipe lookup plugin, where subprocess.Popen() with shell=True could allow an attacker to overwrite ansible facts and run arbitrary commands. The public advisories in connected documents confirm this issue and show mitigations in openSUSE/SUSE updates (e.g., ansibl...

CVE-2020-10729

CVE-2020-10729 describes a vulnerability in Ansible where insufficiently random values cause two password lookups of the same length to produce identical results during template caching, potentially exposing all passwords for a file. Affected: Ansible Engine versions before 2.9.6. Root cause: re-...

CVE-2016-8647

CVE-2016-8647 affects Ansible’s mysql_user module before 2.2.1.0. The issue is an input validation vulnerability that may fail to correctly change a password, leaving the previous password active. The provided documents do not specify exploit details, affected versions beyond the stated pre-2.2.1...