CVE-2021-20191 (GCVE-0-2021-20191)

Vulnerability from cvelistv5 – Published: 2021-05-26 00:00 – Updated: 2024-08-03 17:30
VLAI
Summary
A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest threat from this vulnerability is to data confidentiality. Versions before ansible 2.9.18 are affected.
Severity
No CVSS data available.
CWE
Assigner
References
Impacted products
Vendor Product Version
n/a ansible Affected: ansible 2.9.18
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:30:07.571Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1916813"
          },
          {
            "name": "[debian-lts-announce] 20231228 [SECURITY] [DLA 3695-1] ansible security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ansible",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "ansible 2.9.18"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest threat from this vulnerability is to data confidentiality. Versions before ansible 2.9.18 are affected."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-532",
              "description": "CWE-532",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-28T19:06:26.846Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1916813"
        },
        {
          "name": "[debian-lts-announce] 20231228 [SECURITY] [DLA 3695-1] ansible security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2021-20191",
    "datePublished": "2021-05-26T00:00:00.000Z",
    "dateReserved": "2020-12-17T00:00:00.000Z",
    "dateUpdated": "2024-08-03T17:30:07.571Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-20191",
      "date": "2026-05-30",
      "epss": "0.00024",
      "percentile": "0.07158"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:virtualization:4.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A303983A-E6D6-4CBC-B2DC-0293EFB623AC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"2.8.19\", \"matchCriteriaId\": \"5863EEF1-48B9-4DCC-A34C-5881E5588C19\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"2.9.0\", \"versionEndExcluding\": \"2.9.18\", \"matchCriteriaId\": \"2D02759E-9C13-45D9-B86D-282A1150AF9B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"2.10.0\", \"versionEndExcluding\": \"2.10.7\", \"matchCriteriaId\": \"17362C62-F75B-456C-9E10-475DF200937E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:ansible_tower:3.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B31C575C-06D2-4CAF-A5B7-B9469B3ED55F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:cisco_nx-os_collection:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"1.4.0\", \"matchCriteriaId\": \"F583BB1E-C512-4101-8E08-8BAEEBA919AE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:community_general_collection:*:*:*:*:*:ansible:*:*\", \"versionEndExcluding\": \"1.3.6\", \"matchCriteriaId\": \"059C2063-6AFB-4741-91BA-03869574A93F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:community_general_collection:*:*:*:*:*:ansible:*:*\", \"versionStartIncluding\": \"2.0.0\", \"versionEndExcluding\": \"2.0.1\", \"matchCriteriaId\": \"C91F2FC2-9231-423E-89B1-6DC68F56C58E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:community_network_collection:*:*:*:*:*:ansible:*:*\", \"versionEndExcluding\": \"1.3.2\", \"matchCriteriaId\": \"D81319F0-E840-4A76-B2B4-21F8F6E9535D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:community_network_collection:*:*:*:*:*:ansible:*:*\", \"versionStartIncluding\": \"2.0.0\", \"versionEndExcluding\": \"2.0.1\", \"matchCriteriaId\": \"2DFEB5AE-7E63-417A-ADA5-D7FF03E3BDD9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:docker_community_collection:*:*:*:*:*:ansible:*:*\", \"versionEndExcluding\": \"1.2.2\", \"matchCriteriaId\": \"4C27F139-C636-47E1-8BA4-6487DE2F0801\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:google_cloud_platform_ansible_collection:1.0.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2D000027-CB3B-4465-B0B6-546B334A8D58\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest threat from this vulnerability is to data confidentiality. Versions before ansible 2.9.18 are affected.\"}, {\"lang\": \"es\", \"value\": \"Se encontr\\u00f3 un fallo en ansible.\u0026#xa0;Las credenciales, como los secretos, son divulgadas en el registro de la consola por defecto y no est\\u00e1n protegidas por la funci\\u00f3n no_log cuando son usados esos m\\u00f3dulos.\u0026#xa0;Un atacante puede tomar ventaja de esta informaci\\u00f3n para robar esas credenciales.\u0026#xa0;La mayor amenaza de esta vulnerabilidad es la confidencialidad de los datos.\u0026#xa0;Las versiones anteriores a ansible versi\\u00f3n 2.9.18 est\\u00e1n afectadas\"}]",
      "id": "CVE-2021-20191",
      "lastModified": "2024-11-21T05:46:06.130",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:L/AC:L/Au:N/C:P/I:N/A:N\", \"baseScore\": 2.1, \"accessVector\": \"LOCAL\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"LOW\", \"exploitabilityScore\": 3.9, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2021-05-26T21:15:08.193",
      "references": "[{\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=1916813\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Issue Tracking\", \"Vendor Advisory\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=1916813\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Issue Tracking\", \"Vendor Advisory\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "secalert@redhat.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"secalert@redhat.com\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-532\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-20191\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2021-05-26T21:15:08.193\",\"lastModified\":\"2024-11-21T05:46:06.130\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest threat from this vulnerability is to data confidentiality. Versions before ansible 2.9.18 are affected.\"},{\"lang\":\"es\",\"value\":\"Se encontr\u00f3 un fallo en ansible.\u0026#xa0;Las credenciales, como los secretos, son divulgadas en el registro de la consola por defecto y no est\u00e1n protegidas por la funci\u00f3n no_log cuando son usados esos m\u00f3dulos.\u0026#xa0;Un atacante puede tomar ventaja de esta informaci\u00f3n para robar esas credenciales.\u0026#xa0;La mayor amenaza de esta vulnerabilidad es la confidencialidad de los datos.\u0026#xa0;Las versiones anteriores a ansible versi\u00f3n 2.9.18 est\u00e1n afectadas\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:L/Au:N/C:P/I:N/A:N\",\"baseScore\":2.1,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":3.9,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-532\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:virtualization:4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A303983A-E6D6-4CBC-B2DC-0293EFB623AC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.8.19\",\"matchCriteriaId\":\"5863EEF1-48B9-4DCC-A34C-5881E5588C19\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.9.0\",\"versionEndExcluding\":\"2.9.18\",\"matchCriteriaId\":\"2D02759E-9C13-45D9-B86D-282A1150AF9B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.10.0\",\"versionEndExcluding\":\"2.10.7\",\"matchCriteriaId\":\"17362C62-F75B-456C-9E10-475DF200937E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:ansible_tower:3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B31C575C-06D2-4CAF-A5B7-B9469B3ED55F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:cisco_nx-os_collection:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.4.0\",\"matchCriteriaId\":\"F583BB1E-C512-4101-8E08-8BAEEBA919AE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:community_general_collection:*:*:*:*:*:ansible:*:*\",\"versionEndExcluding\":\"1.3.6\",\"matchCriteriaId\":\"059C2063-6AFB-4741-91BA-03869574A93F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:community_general_collection:*:*:*:*:*:ansible:*:*\",\"versionStartIncluding\":\"2.0.0\",\"versionEndExcluding\":\"2.0.1\",\"matchCriteriaId\":\"C91F2FC2-9231-423E-89B1-6DC68F56C58E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:community_network_collection:*:*:*:*:*:ansible:*:*\",\"versionEndExcluding\":\"1.3.2\",\"matchCriteriaId\":\"D81319F0-E840-4A76-B2B4-21F8F6E9535D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:community_network_collection:*:*:*:*:*:ansible:*:*\",\"versionStartIncluding\":\"2.0.0\",\"versionEndExcluding\":\"2.0.1\",\"matchCriteriaId\":\"2DFEB5AE-7E63-417A-ADA5-D7FF03E3BDD9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:docker_community_collection:*:*:*:*:*:ansible:*:*\",\"versionEndExcluding\":\"1.2.2\",\"matchCriteriaId\":\"4C27F139-C636-47E1-8BA4-6487DE2F0801\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:google_cloud_platform_ansible_collection:1.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2D000027-CB3B-4465-B0B6-546B334A8D58\"}]}]}],\"references\":[{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=1916813\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Issue Tracking\",\"Vendor Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=1916813\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Vendor Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.