Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2021-3620 (GCVE-0-2021-3620)
Vulnerability from cvelistv5 – Published: 2022-03-03 18:23 – Updated: 2025-02-13 16:28- CWE-209 - - Generation of Error Message Containing Sensitive Information
| URL | Tags |
|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=1975767 | x_refsource_MISC |
| https://github.com/ansible/ansible/blob/stable-2.… | x_refsource_MISC |
| https://github.com/ansible/ansible/commit/fe28767… | x_refsource_MISC |
| https://lists.debian.org/debian-lts-announce/2023… |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T17:01:07.670Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1975767"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/ansible/ansible/blob/stable-2.9/changelogs/CHANGELOG-v2.9.rst#security-fixes"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/ansible/ansible/commit/fe28767970c8ec62aabe493c46b53a5de1e5fac0"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-3620",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-15T17:09:25.955830Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-15T17:13:51.591Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "ansible",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "Fixed in Ansible Engine v2.9.27"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in Ansible Engine\u0027s ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-209",
"description": "CWE-209 - Generation of Error Message Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-12-28T19:06:30.310Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1975767"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ansible/ansible/blob/stable-2.9/changelogs/CHANGELOG-v2.9.rst#security-fixes"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ansible/ansible/commit/fe28767970c8ec62aabe493c46b53a5de1e5fac0"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2021-3620",
"datePublished": "2022-03-03T18:23:38.000Z",
"dateReserved": "2021-06-24T00:00:00.000Z",
"dateUpdated": "2025-02-13T16:28:25.255Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2021-3620",
"date": "2026-05-25",
"epss": "0.0029",
"percentile": "0.52501"
},
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:ansible_automation_platform_early_access:2.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E3871C74-20C4-4212-AEF1-D792637A92B8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:ansible_engine:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"2.9.27\", \"matchCriteriaId\": \"19A338B7-0C96-497E-AF9C-EA78F143CCBE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:openstack:1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4B7FF772-FC99-435A-8D6F-6999656B9593\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:openstack:16.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C9D3F4FF-AD3D-4D17-93E8-84CAFCED2F59\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6BBD7A51-0590-4DDF-8249-5AFA8D645CB6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:virtualization_for_ibm_power_little_endian:4.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"FDE26BBE-BD17-43B4-9C3F-B009F5AD0396\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"BB28F9AF-3D06-4532-B397-96D7E4792503\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:virtualization_manager:4.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E0E1B0D8-7067-4FE7-A309-917AE4D59E7E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F4CFF558-3C47-480D-A2F0-BABF26042943\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"47811209-5CE5-4375-8391-B0A7F6A0E420\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"A flaw was found in Ansible Engine\u0027s ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality.\"}, {\"lang\": \"es\", \"value\": \"Se ha encontrado un fallo en el m\\u00f3dulo ansible-connection de Ansible Engine, en el que informaci\\u00f3n confidencial, como las credenciales de usuario de Ansible, es revelado por defecto en el mensaje de error de rastreo. La mayor amenaza de esta vulnerabilidad es la confidencialidad\"}]",
"id": "CVE-2021-3620",
"lastModified": "2024-11-21T06:22:00.013",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:L/AC:L/Au:N/C:P/I:N/A:N\", \"baseScore\": 2.1, \"accessVector\": \"LOCAL\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"LOW\", \"exploitabilityScore\": 3.9, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
"published": "2022-03-03T19:15:08.237",
"references": "[{\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=1975767\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Issue Tracking\", \"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/ansible/ansible/blob/stable-2.9/changelogs/CHANGELOG-v2.9.rst#security-fixes\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Release Notes\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/ansible/ansible/commit/fe28767970c8ec62aabe493c46b53a5de1e5fac0\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=1975767\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Issue Tracking\", \"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/ansible/ansible/blob/stable-2.9/changelogs/CHANGELOG-v2.9.rst#security-fixes\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Release Notes\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/ansible/ansible/commit/fe28767970c8ec62aabe493c46b53a5de1e5fac0\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"secalert@redhat.com\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-209\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-209\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2021-3620\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2022-03-03T19:15:08.237\",\"lastModified\":\"2024-11-21T06:22:00.013\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A flaw was found in Ansible Engine\u0027s ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality.\"},{\"lang\":\"es\",\"value\":\"Se ha encontrado un fallo en el m\u00f3dulo ansible-connection de Ansible Engine, en el que informaci\u00f3n confidencial, como las credenciales de usuario de Ansible, es revelado por defecto en el mensaje de error de rastreo. La mayor amenaza de esta vulnerabilidad es la confidencialidad\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:L/Au:N/C:P/I:N/A:N\",\"baseScore\":2.1,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":3.9,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-209\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-209\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:ansible_automation_platform_early_access:2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E3871C74-20C4-4212-AEF1-D792637A92B8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:ansible_engine:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.9.27\",\"matchCriteriaId\":\"19A338B7-0C96-497E-AF9C-EA78F143CCBE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:openstack:1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4B7FF772-FC99-435A-8D6F-6999656B9593\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:openstack:16.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C9D3F4FF-AD3D-4D17-93E8-84CAFCED2F59\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6BBD7A51-0590-4DDF-8249-5AFA8D645CB6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:virtualization_for_ibm_power_little_endian:4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FDE26BBE-BD17-43B4-9C3F-B009F5AD0396\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BB28F9AF-3D06-4532-B397-96D7E4792503\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:virtualization_manager:4.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0E1B0D8-7067-4FE7-A309-917AE4D59E7E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F4CFF558-3C47-480D-A2F0-BABF26042943\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"47811209-5CE5-4375-8391-B0A7F6A0E420\"}]}]}],\"references\":[{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=1975767\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Issue Tracking\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/ansible/ansible/blob/stable-2.9/changelogs/CHANGELOG-v2.9.rst#security-fixes\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Release Notes\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/ansible/ansible/commit/fe28767970c8ec62aabe493c46b53a5de1e5fac0\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=1975767\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/ansible/ansible/blob/stable-2.9/changelogs/CHANGELOG-v2.9.rst#security-fixes\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Release Notes\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/ansible/ansible/commit/fe28767970c8ec62aabe493c46b53a5de1e5fac0\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=1975767\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/ansible/ansible/blob/stable-2.9/changelogs/CHANGELOG-v2.9.rst#security-fixes\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/ansible/ansible/commit/fe28767970c8ec62aabe493c46b53a5de1e5fac0\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-03T17:01:07.670Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-3620\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-15T17:09:25.955830Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-15T17:11:00.579Z\"}}], \"cna\": {\"affected\": [{\"vendor\": \"n/a\", \"product\": \"ansible\", \"versions\": [{\"status\": \"affected\", \"version\": \"Fixed in Ansible Engine v2.9.27\"}]}], \"references\": [{\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=1975767\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/ansible/ansible/blob/stable-2.9/changelogs/CHANGELOG-v2.9.rst#security-fixes\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/ansible/ansible/commit/fe28767970c8ec62aabe493c46b53a5de1e5fac0\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A flaw was found in Ansible Engine\u0027s ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-209\", \"description\": \"CWE-209 - Generation of Error Message Containing Sensitive Information\"}]}], \"providerMetadata\": {\"orgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"shortName\": \"redhat\", \"dateUpdated\": \"2022-03-03T18:23:38\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2021-3620\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-10-15T17:13:51.591Z\", \"dateReserved\": \"2021-06-24T00:00:00\", \"assignerOrgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"datePublished\": \"2022-03-03T18:23:38\", \"assignerShortName\": \"redhat\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
BDU:2024-06959
Vulnerability from fstec - Published: 24.06.2021{
"CVSS 2.0": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
"CVSS 3.0": "AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"CVSS 4.0": null,
"remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
"remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
"\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "\u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f, \u041e\u041e\u041e \u00ab\u0420\u0435\u0434 \u0421\u043e\u0444\u0442\u00bb, \u041e\u041e\u041e \u00ab\u0420\u0443\u0441\u0411\u0418\u0422\u0435\u0445-\u0410\u0441\u0442\u0440\u0430\u00bb, Red Hat Inc.",
"\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "9 (Debian GNU/Linux), 10 (Debian GNU/Linux), 11 (Debian GNU/Linux), 12 (Debian GNU/Linux), 7.3 (\u0420\u0415\u0414 \u041e\u0421), 1.7 (Astra Linux Special Edition), 4.7 (Astra Linux Special Edition), 1.6 \u00ab\u0421\u043c\u043e\u043b\u0435\u043d\u0441\u043a\u00bb (Astra Linux Common Edition), \u0434\u043e 2.9.27 (Ansible Core), \u0434\u043e 2.9.27 (Ansible), \u0434\u043e 2.9.27 (Ansible Base)",
"\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0414\u043b\u044f Ansible Core:\n\u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f: https://github.com/ansible/ansible/commit/fe28767970c8ec62aabe493c46b53a5de1e5fac0\n\u0414\u043b\u044f Ansible:\n\u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f: https://github.com/ansible/ansible/blob/stable-2.9/changelogs/CHANGELOG-v2.9.rst#security-fixes\n\u0414\u043b\u044f Ansible Base:\n\u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f: https://github.com/ansible/ansible/commit/79e9dae29212a88aa60122ca6bd608947399017f\n\u0414\u043b\u044f Debian:\n\u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f: https://security-tracker.debian.org/tracker/CVE-2021-3620\n\u0414\u043b\u044f \u041e\u0421 Astra Linux:\n\u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u0430\u043a\u0435\u0442 ansible \u0434\u043e 2.7.7+dfsg-1+deb10u2 \u0438\u043b\u0438 \u0431\u043e\u043b\u0435\u0435 \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f: https://wiki.astralinux.ru/astra-linux-se17-bulletin-2024-0830SE17\n\n\u0414\u043b\u044f Astra Linux Special Edition 4.7 \u0434\u043b\u044f \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b ARM:\n\u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u0430\u043a\u0435\u0442 ansible \u0434\u043e 2.7.7+dfsg-1+deb10u2 \u0438\u043b\u0438 \u0431\u043e\u043b\u0435\u0435 \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f: https://wiki.astralinux.ru/astra-linux-se47-bulletin-2024-1031SE47\n\n\u0414\u043b\u044f \u0420\u0435\u0434\u041e\u0421: \nhttp://repo.red-soft.ru/redos/7.3c/x86_64/updates/\n\n\u0414\u043b\u044f \u041e\u0421 Astra Linux:\n\u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u0430\u043a\u0435\u0442 ansible \u0434\u043e 2.7.7+dfsg-1+deb10u2 \u0438\u043b\u0438 \u0431\u043e\u043b\u0435\u0435 \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f: https://wiki.astralinux.ru/astra-linux-se16-bulletin-20251225SE16",
"\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "24.06.2021",
"\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "20.01.2026",
"\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "13.09.2024",
"\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2024-06959",
"\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2021-3620",
"\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
"\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
"\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Debian GNU/Linux, \u0420\u0415\u0414 \u041e\u0421 (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21163751), Astra Linux Special Edition (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u2116369), Astra Linux Common Edition (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21164433), Ansible Core, Ansible, Ansible Base",
"\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "\u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 9 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 10 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 11 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 12 , \u041e\u041e\u041e \u00ab\u0420\u0435\u0434 \u0421\u043e\u0444\u0442\u00bb \u0420\u0415\u0414 \u041e\u0421 7.3 (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21163751), \u041e\u041e\u041e \u00ab\u0420\u0443\u0441\u0411\u0418\u0422\u0435\u0445-\u0410\u0441\u0442\u0440\u0430\u00bb Astra Linux Special Edition 1.7 (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u2116369), \u041e\u041e\u041e \u00ab\u0420\u0443\u0441\u0411\u0418\u0422\u0435\u0445-\u0410\u0441\u0442\u0440\u0430\u00bb Astra Linux Special Edition 4.7 ARM (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u2116369), \u041e\u041e\u041e \u00ab\u0420\u0443\u0441\u0411\u0418\u0422\u0435\u0445-\u0410\u0441\u0442\u0440\u0430\u00bb Astra Linux Common Edition 1.6 \u00ab\u0421\u043c\u043e\u043b\u0435\u043d\u0441\u043a\u00bb (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21164433)",
"\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0434\u0443\u043b\u044f ansible-connection \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f\u043c\u0438 Ansible Core, Ansible, Ansible Base, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u0435\u043c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0432 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f\u0445 \u043e\u0431 \u043e\u0448\u0438\u0431\u043a\u0430\u0445, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u043c \u0434\u0430\u043d\u043d\u044b\u043c",
"\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
"\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u0423\u0442\u0435\u0447\u043a\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0432 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f\u0445 \u043e\u0431 \u043e\u0448\u0438\u0431\u043a\u0430\u0445 (CWE-209)",
"\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0434\u0443\u043b\u044f ansible-connection \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f\u043c\u0438 Ansible Core, Ansible, Ansible Base \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u0435\u043c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0432 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f\u0445 \u043e\u0431 \u043e\u0448\u0438\u0431\u043a\u0430\u0445. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u043c \u0434\u0430\u043d\u043d\u044b\u043c",
"\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
"\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
"\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
"\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
"\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
"\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0440\u043e\u043a\u0430\u043c\u0438 \u0438 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435\u043c",
"\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://bugzilla.redhat.com/show_bug.cgi?id=1975767\nhttps://github.com/ansible/ansible/blob/stable-2.9/changelogs/CHANGELOG-v2.9.rst#security-fixes\nhttps://github.com/ansible/ansible/commit/79e9dae29212a88aa60122ca6bd608947399017f\nhttps://github.com/ansible/ansible/commit/fe28767970c8ec62aabe493c46b53a5de1e5fac0\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-3620\nhttps://security-tracker.debian.org/tracker/CVE-2021-3620\nhttps://wiki.astralinux.ru/astra-linux-se17-bulletin-2024-0830SE17\nhttps://wiki.astralinux.ru/astra-linux-se47-bulletin-2024-1031SE47\nhttp://repo.red-soft.ru/redos/7.3c/x86_64/updates/\nhttps://wiki.astralinux.ru/astra-linux-se16-bulletin-20251225SE16",
"\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
"\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430, \u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c, \u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e",
"\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-209",
"\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 4,6)\n\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 5,5)"
}
FKIE_CVE-2021-3620
Vulnerability from fkie_nvd - Published: 2022-03-03 19:15 - Updated: 2024-11-21 06:22| Vendor | Product | Version | |
|---|---|---|---|
| redhat | ansible_automation_platform_early_access | 2.0 | |
| redhat | ansible_engine | * | |
| redhat | openstack | 1 | |
| redhat | openstack | 16.1 | |
| redhat | virtualization | 4.0 | |
| redhat | virtualization_for_ibm_power_little_endian | 4.0 | |
| redhat | virtualization_host | 4.0 | |
| redhat | virtualization_manager | 4.4 | |
| redhat | enterprise_linux | 8.0 | |
| redhat | enterprise_linux_for_power_little_endian | 8.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:redhat:ansible_automation_platform_early_access:2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E3871C74-20C4-4212-AEF1-D792637A92B8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:ansible_engine:*:*:*:*:*:*:*:*",
"matchCriteriaId": "19A338B7-0C96-497E-AF9C-EA78F143CCBE",
"versionEndExcluding": "2.9.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:openstack:1:*:*:*:*:*:*:*",
"matchCriteriaId": "4B7FF772-FC99-435A-8D6F-6999656B9593",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:openstack:16.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C9D3F4FF-AD3D-4D17-93E8-84CAFCED2F59",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "6BBD7A51-0590-4DDF-8249-5AFA8D645CB6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:virtualization_for_ibm_power_little_endian:4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "FDE26BBE-BD17-43B4-9C3F-B009F5AD0396",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "BB28F9AF-3D06-4532-B397-96D7E4792503",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:virtualization_manager:4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "E0E1B0D8-7067-4FE7-A309-917AE4D59E7E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F4CFF558-3C47-480D-A2F0-BABF26042943",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "47811209-5CE5-4375-8391-B0A7F6A0E420",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in Ansible Engine\u0027s ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality."
},
{
"lang": "es",
"value": "Se ha encontrado un fallo en el m\u00f3dulo ansible-connection de Ansible Engine, en el que informaci\u00f3n confidencial, como las credenciales de usuario de Ansible, es revelado por defecto en el mensaje de error de rastreo. La mayor amenaza de esta vulnerabilidad es la confidencialidad"
}
],
"id": "CVE-2021-3620",
"lastModified": "2024-11-21T06:22:00.013",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-03-03T19:15:08.237",
"references": [
{
"source": "secalert@redhat.com",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1975767"
},
{
"source": "secalert@redhat.com",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/ansible/ansible/blob/stable-2.9/changelogs/CHANGELOG-v2.9.rst#security-fixes"
},
{
"source": "secalert@redhat.com",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/ansible/ansible/commit/fe28767970c8ec62aabe493c46b53a5de1e5fac0"
},
{
"source": "secalert@redhat.com",
"url": "https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1975767"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/ansible/ansible/blob/stable-2.9/changelogs/CHANGELOG-v2.9.rst#security-fixes"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/ansible/ansible/commit/fe28767970c8ec62aabe493c46b53a5de1e5fac0"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-209"
}
],
"source": "secalert@redhat.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-209"
}
],
"source": "nvd@nist.gov",
"type": "Secondary"
}
]
}
GHSA-4R65-35QQ-CH8J
Vulnerability from github – Published: 2022-03-04 00:00 – Updated: 2024-09-09 21:00Ansible is an IT automation system that handles configuration management, application deployment, cloud provisioning, ad-hoc task execution, network automation, and multi-node orchestration. A flaw was found in Ansible Engine's ansible-connection module where sensitive information, such as the Ansible user credentials, is disclosed by default in the traceback error message when Ansible receives an unexpected response from set_options. The highest threat from this vulnerability is confidentiality.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "ansible"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.9.27"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-3620"
],
"database_specific": {
"cwe_ids": [
"CWE-209"
],
"github_reviewed": true,
"github_reviewed_at": "2022-03-24T21:40:53Z",
"nvd_published_at": "2022-03-03T19:15:00Z",
"severity": "MODERATE"
},
"details": "Ansible is an IT automation system that handles configuration management, application deployment, cloud provisioning, ad-hoc task execution, network automation, and multi-node orchestration. A flaw was found in Ansible Engine\u0027s ansible-connection module where sensitive information, such as the Ansible user credentials, is disclosed by default in the traceback error message when Ansible receives an unexpected response from `set_options`. The highest threat from this vulnerability is confidentiality.",
"id": "GHSA-4r65-35qq-ch8j",
"modified": "2024-09-09T21:00:59Z",
"published": "2022-03-04T00:00:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3620"
},
{
"type": "WEB",
"url": "https://github.com/ansible/ansible/commit/fe28767970c8ec62aabe493c46b53a5de1e5fac0"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2021:3871"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2021:3872"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2021:3874"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2021:4703"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2021:4750"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2021-3620"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1975767"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-4r65-35qq-ch8j"
},
{
"type": "PACKAGE",
"url": "https://github.com/ansible/ansible"
},
{
"type": "WEB",
"url": "https://github.com/ansible/ansible/blob/stable-2.9/changelogs/CHANGELOG-v2.9.rst#security-fixes"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2022-164.yaml"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Ansible discloses sensitive information in traceback error message"
}
GSD-2021-3620
Vulnerability from gsd - Updated: 2023-12-13 01:23{
"GSD": {
"alias": "CVE-2021-3620",
"description": "A flaw was found in Ansible Engine\u0027s ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality.",
"id": "GSD-2021-3620",
"references": [
"https://www.suse.com/security/cve/CVE-2021-3620.html",
"https://access.redhat.com/errata/RHSA-2021:4750",
"https://access.redhat.com/errata/RHSA-2021:4703",
"https://access.redhat.com/errata/RHSA-2021:3874",
"https://access.redhat.com/errata/RHSA-2021:3872",
"https://access.redhat.com/errata/RHSA-2021:3871",
"https://advisories.mageia.org/CVE-2021-3620.html",
"https://security.archlinux.org/CVE-2021-3620",
"https://ubuntu.com/security/CVE-2021-3620"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2021-3620"
],
"details": "A flaw was found in Ansible Engine\u0027s ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality.",
"id": "GSD-2021-3620",
"modified": "2023-12-13T01:23:35.107484Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2021-3620",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "ansible",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "Fixed in Ansible Engine v2.9.27"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A flaw was found in Ansible Engine\u0027s ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"cweId": "CWE-209",
"lang": "eng",
"value": "CWE-209 - Generation of Error Message Containing Sensitive Information"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=1975767",
"refsource": "MISC",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1975767"
},
{
"name": "https://github.com/ansible/ansible/blob/stable-2.9/changelogs/CHANGELOG-v2.9.rst#security-fixes",
"refsource": "MISC",
"url": "https://github.com/ansible/ansible/blob/stable-2.9/changelogs/CHANGELOG-v2.9.rst#security-fixes"
},
{
"name": "https://github.com/ansible/ansible/commit/fe28767970c8ec62aabe493c46b53a5de1e5fac0",
"refsource": "MISC",
"url": "https://github.com/ansible/ansible/commit/fe28767970c8ec62aabe493c46b53a5de1e5fac0"
},
{
"name": "https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html",
"refsource": "MISC",
"url": "https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html"
}
]
}
},
"gitlab.com": {
"advisories": [
{
"affected_range": "==2.0",
"affected_versions": "Version 2.0",
"cvss_v2": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
"cvss_v3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cwe_ids": [
"CWE-1035",
"CWE-209",
"CWE-937"
],
"date": "2023-02-12",
"description": "A flaw was found in Ansible Engine\u0027s ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality.",
"fixed_versions": [
"2.11.0"
],
"identifier": "CVE-2021-3620",
"identifiers": [
"CVE-2021-3620"
],
"not_impacted": "All versions before 2.0, all versions after 2.0",
"package_slug": "pypi/ansible-core",
"pubdate": "2022-03-03",
"solution": "Upgrade to version 2.11.0 or above.",
"title": "Generation of Error Message Containing Sensitive Information",
"urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2021-3620",
"https://github.com/ansible/ansible/commit/fe28767970c8ec62aabe493c46b53a5de1e5fac0",
"https://github.com/ansible/ansible/blob/stable-2.9/changelogs/CHANGELOG-v2.9.rst#security-fixes",
"https://bugzilla.redhat.com/show_bug.cgi?id=1975767"
],
"uuid": "3a9b5002-5f80-4adb-83ef-8b445ffb1082"
},
{
"affected_range": "\u003c2.9.27",
"affected_versions": "All versions before 2.9.27",
"cvss_v2": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
"cvss_v3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cwe_ids": [
"CWE-1035",
"CWE-209",
"CWE-937"
],
"date": "2023-02-12",
"description": "A flaw was found in Ansible Engine\u0027s ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality.",
"fixed_versions": [
"2.9.27"
],
"identifier": "CVE-2021-3620",
"identifiers": [
"CVE-2021-3620"
],
"not_impacted": "All versions starting from 2.9.27",
"package_slug": "pypi/ansible",
"pubdate": "2022-03-03",
"solution": "Upgrade to version 2.9.27 or above.",
"title": "Generation of Error Message Containing Sensitive Information",
"urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2021-3620",
"https://github.com/ansible/ansible/commit/fe28767970c8ec62aabe493c46b53a5de1e5fac0",
"https://github.com/ansible/ansible/blob/stable-2.9/changelogs/CHANGELOG-v2.9.rst#security-fixes",
"https://bugzilla.redhat.com/show_bug.cgi?id=1975767"
],
"uuid": "7ed6d263-a35a-4c59-b98b-13790da6eeb6"
}
]
},
"nvd.nist.gov": {
"cve": {
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:redhat:ansible_automation_platform_early_access:2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E3871C74-20C4-4212-AEF1-D792637A92B8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:ansible_engine:*:*:*:*:*:*:*:*",
"matchCriteriaId": "19A338B7-0C96-497E-AF9C-EA78F143CCBE",
"versionEndExcluding": "2.9.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:openstack:1:*:*:*:*:*:*:*",
"matchCriteriaId": "4B7FF772-FC99-435A-8D6F-6999656B9593",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:openstack:16.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C9D3F4FF-AD3D-4D17-93E8-84CAFCED2F59",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "6BBD7A51-0590-4DDF-8249-5AFA8D645CB6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:virtualization_for_ibm_power_little_endian:4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "FDE26BBE-BD17-43B4-9C3F-B009F5AD0396",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "BB28F9AF-3D06-4532-B397-96D7E4792503",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:virtualization_manager:4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "E0E1B0D8-7067-4FE7-A309-917AE4D59E7E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F4CFF558-3C47-480D-A2F0-BABF26042943",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "47811209-5CE5-4375-8391-B0A7F6A0E420",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in Ansible Engine\u0027s ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality."
},
{
"lang": "es",
"value": "Se ha encontrado un fallo en el m\u00f3dulo ansible-connection de Ansible Engine, en el que informaci\u00f3n confidencial, como las credenciales de usuario de Ansible, es revelado por defecto en el mensaje de error de rastreo. La mayor amenaza de esta vulnerabilidad es la confidencialidad"
}
],
"id": "CVE-2021-3620",
"lastModified": "2023-12-28T19:15:13.103",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-03-03T19:15:08.237",
"references": [
{
"source": "secalert@redhat.com",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1975767"
},
{
"source": "secalert@redhat.com",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/ansible/ansible/blob/stable-2.9/changelogs/CHANGELOG-v2.9.rst#security-fixes"
},
{
"source": "secalert@redhat.com",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/ansible/ansible/commit/fe28767970c8ec62aabe493c46b53a5de1e5fac0"
},
{
"source": "secalert@redhat.com",
"url": "https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-209"
}
],
"source": "secalert@redhat.com",
"type": "Primary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-209"
}
],
"source": "nvd@nist.gov",
"type": "Secondary"
}
]
}
}
}
}
MSRC_CVE-2021-3620
Vulnerability from csaf_microsoft - Published: 2022-03-02 00:00 - Updated: 2022-03-16 00:00| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 18892-16820 | — |
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 16820-1 | — |
Vendor Fix
fix
|
| URL | Category |
|---|---|
| https://msrc.microsoft.com/csaf/vex/2022/msrc_cve… | self |
| https://support.microsoft.com/lifecycle | external |
| https://www.first.org/cvss | external |
| https://msrc.microsoft.com/csaf/vex/2022/msrc_cve… | self |
{
"document": {
"category": "csaf_vex",
"csaf_version": "2.0",
"distribution": {
"text": "Public",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en-US",
"notes": [
{
"category": "general",
"text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
"title": "Disclaimer"
}
],
"publisher": {
"category": "vendor",
"contact_details": "secure@microsoft.com",
"name": "Microsoft Security Response Center",
"namespace": "https://msrc.microsoft.com"
},
"references": [
{
"category": "self",
"summary": "CVE-2021-3620 A flaw was found in Ansible Engine\u0027s ansible-connection module where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality. - VEX",
"url": "https://msrc.microsoft.com/csaf/vex/2022/msrc_cve-2021-3620.json"
},
{
"category": "external",
"summary": "Microsoft Support Lifecycle",
"url": "https://support.microsoft.com/lifecycle"
},
{
"category": "external",
"summary": "Common Vulnerability Scoring System",
"url": "https://www.first.org/cvss"
}
],
"title": "A flaw was found in Ansible Engine\u0027s ansible-connection module where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality.",
"tracking": {
"current_release_date": "2022-03-16T00:00:00.000Z",
"generator": {
"date": "2025-10-19T23:23:33.140Z",
"engine": {
"name": "MSRC Generator",
"version": "1.0"
}
},
"id": "msrc_CVE-2021-3620",
"initial_release_date": "2022-03-02T00:00:00.000Z",
"revision_history": [
{
"date": "2022-03-16T00:00:00.000Z",
"legacy_version": "1",
"number": "1",
"summary": "Information published."
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "1.0",
"product": {
"name": "CBL Mariner 1.0",
"product_id": "16820"
}
}
],
"category": "product_name",
"name": "Azure Linux"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003ccm1 ansible 2.9.27-1",
"product": {
"name": "\u003ccm1 ansible 2.9.27-1",
"product_id": "1"
}
},
{
"category": "product_version",
"name": "cm1 ansible 2.9.27-1",
"product": {
"name": "cm1 ansible 2.9.27-1",
"product_id": "18892"
}
}
],
"category": "product_name",
"name": "ansible"
}
],
"category": "vendor",
"name": "Microsoft"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "\u003ccm1 ansible 2.9.27-1 as a component of CBL Mariner 1.0",
"product_id": "16820-1"
},
"product_reference": "1",
"relates_to_product_reference": "16820"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cm1 ansible 2.9.27-1 as a component of CBL Mariner 1.0",
"product_id": "18892-16820"
},
"product_reference": "18892",
"relates_to_product_reference": "16820"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2021-3620",
"cwe": {
"id": "CWE-209",
"name": "Generation of Error Message Containing Sensitive Information"
},
"notes": [
{
"category": "general",
"text": "redhat",
"title": "Assigning CNA"
}
],
"product_status": {
"fixed": [
"18892-16820"
],
"known_affected": [
"16820-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2021-3620 A flaw was found in Ansible Engine\u0027s ansible-connection module where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality. - VEX",
"url": "https://msrc.microsoft.com/csaf/vex/2022/msrc_cve-2021-3620.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"date": "2022-03-16T00:00:00.000Z",
"details": "2.9.27-1:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
"product_ids": [
"16820-1"
],
"url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"environmentalsScore": 0.0,
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 5.5,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"16820-1"
]
}
],
"title": "A flaw was found in Ansible Engine\u0027s ansible-connection module where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality."
}
]
}
OPENSUSE-SU-2024:12302-1
Vulnerability from csaf_opensuse - Published: 2024-06-15 00:00 - Updated: 2024-06-15 00:00| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:ansible-2.9.27-2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:ansible-2.9.27-2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:ansible-2.9.27-2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:ansible-2.9.27-2.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:ansible-doc-2.9.27-2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:ansible-doc-2.9.27-2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:ansible-doc-2.9.27-2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:ansible-doc-2.9.27-2.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:ansible-test-2.9.27-2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:ansible-test-2.9.27-2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:ansible-test-2.9.27-2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:ansible-test-2.9.27-2.1.x86_64 | — |
Vendor Fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:ansible-2.9.27-2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:ansible-2.9.27-2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:ansible-2.9.27-2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:ansible-2.9.27-2.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:ansible-doc-2.9.27-2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:ansible-doc-2.9.27-2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:ansible-doc-2.9.27-2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:ansible-doc-2.9.27-2.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:ansible-test-2.9.27-2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:ansible-test-2.9.27-2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:ansible-test-2.9.27-2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:ansible-test-2.9.27-2.1.x86_64 | — |
Vendor Fix
|
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "ansible-2.9.27-2.1 on GA media",
"title": "Title of the patch"
},
{
"category": "description",
"text": "These are all security issues fixed in the ansible-2.9.27-2.1 package on the GA media of openSUSE Tumbleweed.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Tumbleweed-2024-12302",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_12302-1.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-3447 page",
"url": "https://www.suse.com/security/cve/CVE-2021-3447/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-3620 page",
"url": "https://www.suse.com/security/cve/CVE-2021-3620/"
}
],
"title": "ansible-2.9.27-2.1 on GA media",
"tracking": {
"current_release_date": "2024-06-15T00:00:00Z",
"generator": {
"date": "2024-06-15T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2024:12302-1",
"initial_release_date": "2024-06-15T00:00:00Z",
"revision_history": [
{
"date": "2024-06-15T00:00:00Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "ansible-2.9.27-2.1.aarch64",
"product": {
"name": "ansible-2.9.27-2.1.aarch64",
"product_id": "ansible-2.9.27-2.1.aarch64"
}
},
{
"category": "product_version",
"name": "ansible-doc-2.9.27-2.1.aarch64",
"product": {
"name": "ansible-doc-2.9.27-2.1.aarch64",
"product_id": "ansible-doc-2.9.27-2.1.aarch64"
}
},
{
"category": "product_version",
"name": "ansible-test-2.9.27-2.1.aarch64",
"product": {
"name": "ansible-test-2.9.27-2.1.aarch64",
"product_id": "ansible-test-2.9.27-2.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "ansible-2.9.27-2.1.ppc64le",
"product": {
"name": "ansible-2.9.27-2.1.ppc64le",
"product_id": "ansible-2.9.27-2.1.ppc64le"
}
},
{
"category": "product_version",
"name": "ansible-doc-2.9.27-2.1.ppc64le",
"product": {
"name": "ansible-doc-2.9.27-2.1.ppc64le",
"product_id": "ansible-doc-2.9.27-2.1.ppc64le"
}
},
{
"category": "product_version",
"name": "ansible-test-2.9.27-2.1.ppc64le",
"product": {
"name": "ansible-test-2.9.27-2.1.ppc64le",
"product_id": "ansible-test-2.9.27-2.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "ansible-2.9.27-2.1.s390x",
"product": {
"name": "ansible-2.9.27-2.1.s390x",
"product_id": "ansible-2.9.27-2.1.s390x"
}
},
{
"category": "product_version",
"name": "ansible-doc-2.9.27-2.1.s390x",
"product": {
"name": "ansible-doc-2.9.27-2.1.s390x",
"product_id": "ansible-doc-2.9.27-2.1.s390x"
}
},
{
"category": "product_version",
"name": "ansible-test-2.9.27-2.1.s390x",
"product": {
"name": "ansible-test-2.9.27-2.1.s390x",
"product_id": "ansible-test-2.9.27-2.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "ansible-2.9.27-2.1.x86_64",
"product": {
"name": "ansible-2.9.27-2.1.x86_64",
"product_id": "ansible-2.9.27-2.1.x86_64"
}
},
{
"category": "product_version",
"name": "ansible-doc-2.9.27-2.1.x86_64",
"product": {
"name": "ansible-doc-2.9.27-2.1.x86_64",
"product_id": "ansible-doc-2.9.27-2.1.x86_64"
}
},
{
"category": "product_version",
"name": "ansible-test-2.9.27-2.1.x86_64",
"product": {
"name": "ansible-test-2.9.27-2.1.x86_64",
"product_id": "ansible-test-2.9.27-2.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Tumbleweed",
"product": {
"name": "openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:tumbleweed"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-2.9.27-2.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:ansible-2.9.27-2.1.aarch64"
},
"product_reference": "ansible-2.9.27-2.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-2.9.27-2.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:ansible-2.9.27-2.1.ppc64le"
},
"product_reference": "ansible-2.9.27-2.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-2.9.27-2.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:ansible-2.9.27-2.1.s390x"
},
"product_reference": "ansible-2.9.27-2.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-2.9.27-2.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:ansible-2.9.27-2.1.x86_64"
},
"product_reference": "ansible-2.9.27-2.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-doc-2.9.27-2.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:ansible-doc-2.9.27-2.1.aarch64"
},
"product_reference": "ansible-doc-2.9.27-2.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-doc-2.9.27-2.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:ansible-doc-2.9.27-2.1.ppc64le"
},
"product_reference": "ansible-doc-2.9.27-2.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-doc-2.9.27-2.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:ansible-doc-2.9.27-2.1.s390x"
},
"product_reference": "ansible-doc-2.9.27-2.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-doc-2.9.27-2.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:ansible-doc-2.9.27-2.1.x86_64"
},
"product_reference": "ansible-doc-2.9.27-2.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-test-2.9.27-2.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:ansible-test-2.9.27-2.1.aarch64"
},
"product_reference": "ansible-test-2.9.27-2.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-test-2.9.27-2.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:ansible-test-2.9.27-2.1.ppc64le"
},
"product_reference": "ansible-test-2.9.27-2.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-test-2.9.27-2.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:ansible-test-2.9.27-2.1.s390x"
},
"product_reference": "ansible-test-2.9.27-2.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-test-2.9.27-2.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:ansible-test-2.9.27-2.1.x86_64"
},
"product_reference": "ansible-test-2.9.27-2.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2021-3447",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-3447"
}
],
"notes": [
{
"category": "general",
"text": "A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged in plain-text on managed nodes, as well as being made visible on the controller node when run in verbose mode. These parameters were not protected by the no_log feature. An attacker can take advantage of this information to steal those credentials, provided when they have access to the log files containing them. The highest threat from this vulnerability is to data confidentiality. This flaw affects Red Hat Ansible Automation Platform in versions before 1.2.2 and Ansible Tower in versions before 3.8.2.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ansible-2.9.27-2.1.aarch64",
"openSUSE Tumbleweed:ansible-2.9.27-2.1.ppc64le",
"openSUSE Tumbleweed:ansible-2.9.27-2.1.s390x",
"openSUSE Tumbleweed:ansible-2.9.27-2.1.x86_64",
"openSUSE Tumbleweed:ansible-doc-2.9.27-2.1.aarch64",
"openSUSE Tumbleweed:ansible-doc-2.9.27-2.1.ppc64le",
"openSUSE Tumbleweed:ansible-doc-2.9.27-2.1.s390x",
"openSUSE Tumbleweed:ansible-doc-2.9.27-2.1.x86_64",
"openSUSE Tumbleweed:ansible-test-2.9.27-2.1.aarch64",
"openSUSE Tumbleweed:ansible-test-2.9.27-2.1.ppc64le",
"openSUSE Tumbleweed:ansible-test-2.9.27-2.1.s390x",
"openSUSE Tumbleweed:ansible-test-2.9.27-2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-3447",
"url": "https://www.suse.com/security/cve/CVE-2021-3447"
},
{
"category": "external",
"summary": "SUSE Bug 1183684 for CVE-2021-3447",
"url": "https://bugzilla.suse.com/1183684"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ansible-2.9.27-2.1.aarch64",
"openSUSE Tumbleweed:ansible-2.9.27-2.1.ppc64le",
"openSUSE Tumbleweed:ansible-2.9.27-2.1.s390x",
"openSUSE Tumbleweed:ansible-2.9.27-2.1.x86_64",
"openSUSE Tumbleweed:ansible-doc-2.9.27-2.1.aarch64",
"openSUSE Tumbleweed:ansible-doc-2.9.27-2.1.ppc64le",
"openSUSE Tumbleweed:ansible-doc-2.9.27-2.1.s390x",
"openSUSE Tumbleweed:ansible-doc-2.9.27-2.1.x86_64",
"openSUSE Tumbleweed:ansible-test-2.9.27-2.1.aarch64",
"openSUSE Tumbleweed:ansible-test-2.9.27-2.1.ppc64le",
"openSUSE Tumbleweed:ansible-test-2.9.27-2.1.s390x",
"openSUSE Tumbleweed:ansible-test-2.9.27-2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:ansible-2.9.27-2.1.aarch64",
"openSUSE Tumbleweed:ansible-2.9.27-2.1.ppc64le",
"openSUSE Tumbleweed:ansible-2.9.27-2.1.s390x",
"openSUSE Tumbleweed:ansible-2.9.27-2.1.x86_64",
"openSUSE Tumbleweed:ansible-doc-2.9.27-2.1.aarch64",
"openSUSE Tumbleweed:ansible-doc-2.9.27-2.1.ppc64le",
"openSUSE Tumbleweed:ansible-doc-2.9.27-2.1.s390x",
"openSUSE Tumbleweed:ansible-doc-2.9.27-2.1.x86_64",
"openSUSE Tumbleweed:ansible-test-2.9.27-2.1.aarch64",
"openSUSE Tumbleweed:ansible-test-2.9.27-2.1.ppc64le",
"openSUSE Tumbleweed:ansible-test-2.9.27-2.1.s390x",
"openSUSE Tumbleweed:ansible-test-2.9.27-2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2021-3447"
},
{
"cve": "CVE-2021-3620",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-3620"
}
],
"notes": [
{
"category": "general",
"text": "A flaw was found in Ansible Engine\u0027s ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ansible-2.9.27-2.1.aarch64",
"openSUSE Tumbleweed:ansible-2.9.27-2.1.ppc64le",
"openSUSE Tumbleweed:ansible-2.9.27-2.1.s390x",
"openSUSE Tumbleweed:ansible-2.9.27-2.1.x86_64",
"openSUSE Tumbleweed:ansible-doc-2.9.27-2.1.aarch64",
"openSUSE Tumbleweed:ansible-doc-2.9.27-2.1.ppc64le",
"openSUSE Tumbleweed:ansible-doc-2.9.27-2.1.s390x",
"openSUSE Tumbleweed:ansible-doc-2.9.27-2.1.x86_64",
"openSUSE Tumbleweed:ansible-test-2.9.27-2.1.aarch64",
"openSUSE Tumbleweed:ansible-test-2.9.27-2.1.ppc64le",
"openSUSE Tumbleweed:ansible-test-2.9.27-2.1.s390x",
"openSUSE Tumbleweed:ansible-test-2.9.27-2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-3620",
"url": "https://www.suse.com/security/cve/CVE-2021-3620"
},
{
"category": "external",
"summary": "SUSE Bug 1187725 for CVE-2021-3620",
"url": "https://bugzilla.suse.com/1187725"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ansible-2.9.27-2.1.aarch64",
"openSUSE Tumbleweed:ansible-2.9.27-2.1.ppc64le",
"openSUSE Tumbleweed:ansible-2.9.27-2.1.s390x",
"openSUSE Tumbleweed:ansible-2.9.27-2.1.x86_64",
"openSUSE Tumbleweed:ansible-doc-2.9.27-2.1.aarch64",
"openSUSE Tumbleweed:ansible-doc-2.9.27-2.1.ppc64le",
"openSUSE Tumbleweed:ansible-doc-2.9.27-2.1.s390x",
"openSUSE Tumbleweed:ansible-doc-2.9.27-2.1.x86_64",
"openSUSE Tumbleweed:ansible-test-2.9.27-2.1.aarch64",
"openSUSE Tumbleweed:ansible-test-2.9.27-2.1.ppc64le",
"openSUSE Tumbleweed:ansible-test-2.9.27-2.1.s390x",
"openSUSE Tumbleweed:ansible-test-2.9.27-2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:ansible-2.9.27-2.1.aarch64",
"openSUSE Tumbleweed:ansible-2.9.27-2.1.ppc64le",
"openSUSE Tumbleweed:ansible-2.9.27-2.1.s390x",
"openSUSE Tumbleweed:ansible-2.9.27-2.1.x86_64",
"openSUSE Tumbleweed:ansible-doc-2.9.27-2.1.aarch64",
"openSUSE Tumbleweed:ansible-doc-2.9.27-2.1.ppc64le",
"openSUSE Tumbleweed:ansible-doc-2.9.27-2.1.s390x",
"openSUSE Tumbleweed:ansible-doc-2.9.27-2.1.x86_64",
"openSUSE Tumbleweed:ansible-test-2.9.27-2.1.aarch64",
"openSUSE Tumbleweed:ansible-test-2.9.27-2.1.ppc64le",
"openSUSE Tumbleweed:ansible-test-2.9.27-2.1.s390x",
"openSUSE Tumbleweed:ansible-test-2.9.27-2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2021-3620"
}
]
}
PYSEC-2022-164
Vulnerability from pysec - Published: 2022-03-03 19:15 - Updated: 2022-03-15 14:28A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality.
| Name | purl | ansible | pkg:pypi/ansible |
|---|
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "ansible",
"purl": "pkg:pypi/ansible"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "fe28767970c8ec62aabe493c46b53a5de1e5fac0"
}
],
"repo": "https://github.com/ansible/ansible",
"type": "GIT"
},
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.9.27"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.0",
"1.1",
"1.2",
"1.2.1",
"1.2.2",
"1.2.3",
"1.3.0",
"1.3.1",
"1.3.2",
"1.3.3",
"1.3.4",
"1.4",
"1.4.1",
"1.4.2",
"1.4.3",
"1.4.4",
"1.4.5",
"1.5",
"1.5.1",
"1.5.2",
"1.5.3",
"1.5.4",
"1.5.5",
"1.6",
"1.6.1",
"1.6.10",
"1.6.2",
"1.6.3",
"1.6.4",
"1.6.5",
"1.6.6",
"1.6.7",
"1.6.8",
"1.6.9",
"1.7",
"1.7.1",
"1.7.2",
"1.8",
"1.8.1",
"1.8.2",
"1.8.3",
"1.8.4",
"1.9.0",
"1.9.0.1",
"1.9.1",
"1.9.2",
"1.9.3",
"1.9.4",
"1.9.5",
"1.9.6",
"2.0.0",
"2.0.0.0",
"2.0.0.1",
"2.0.0.2",
"2.0.1.0",
"2.0.2.0",
"2.1.0.0",
"2.1.1.0",
"2.1.2.0",
"2.1.3.0",
"2.1.4.0",
"2.1.5.0",
"2.1.6.0",
"2.2.0.0",
"2.2.1.0",
"2.2.2.0",
"2.2.3.0",
"2.3.0.0",
"2.3.1.0",
"2.3.2.0",
"2.3.3.0",
"2.4.0.0",
"2.4.1.0",
"2.4.2.0",
"2.4.3.0",
"2.4.4.0",
"2.4.5.0",
"2.4.6.0",
"2.5.0",
"2.5.0a1",
"2.5.0b1",
"2.5.0b2",
"2.5.0rc1",
"2.5.0rc2",
"2.5.0rc3",
"2.5.1",
"2.5.10",
"2.5.11",
"2.5.12",
"2.5.13",
"2.5.14",
"2.5.15",
"2.5.2",
"2.5.3",
"2.5.4",
"2.5.5",
"2.5.6",
"2.5.7",
"2.5.8",
"2.5.9",
"2.6.0",
"2.6.0a1",
"2.6.0a2",
"2.6.0rc1",
"2.6.0rc2",
"2.6.0rc3",
"2.6.0rc4",
"2.6.0rc5",
"2.6.1",
"2.6.10",
"2.6.11",
"2.6.12",
"2.6.13",
"2.6.14",
"2.6.15",
"2.6.16",
"2.6.17",
"2.6.18",
"2.6.19",
"2.6.2",
"2.6.20",
"2.6.3",
"2.6.4",
"2.6.5",
"2.6.6",
"2.6.7",
"2.6.8",
"2.6.9",
"2.7.0",
"2.7.0.dev0",
"2.7.0a1",
"2.7.0b1",
"2.7.0rc1",
"2.7.0rc2",
"2.7.0rc3",
"2.7.0rc4",
"2.7.1",
"2.7.10",
"2.7.11",
"2.7.12",
"2.7.13",
"2.7.14",
"2.7.15",
"2.7.16",
"2.7.17",
"2.7.18",
"2.7.2",
"2.7.3",
"2.7.4",
"2.7.5",
"2.7.6",
"2.7.7",
"2.7.8",
"2.7.9",
"2.8.0",
"2.8.0a1",
"2.8.0b1",
"2.8.0rc1",
"2.8.0rc2",
"2.8.0rc3",
"2.8.1",
"2.8.10",
"2.8.11",
"2.8.12",
"2.8.13",
"2.8.14",
"2.8.15",
"2.8.16",
"2.8.16rc1",
"2.8.17",
"2.8.17rc1",
"2.8.18",
"2.8.18rc1",
"2.8.19",
"2.8.19rc1",
"2.8.2",
"2.8.20",
"2.8.20rc1",
"2.8.3",
"2.8.4",
"2.8.5",
"2.8.6",
"2.8.7",
"2.8.8",
"2.8.9",
"2.9.0",
"2.9.0b1",
"2.9.0rc1",
"2.9.0rc2",
"2.9.0rc3",
"2.9.0rc4",
"2.9.0rc5",
"2.9.1",
"2.9.10",
"2.9.11",
"2.9.12",
"2.9.13",
"2.9.14",
"2.9.14rc1",
"2.9.15",
"2.9.15rc1",
"2.9.16",
"2.9.16rc1",
"2.9.17",
"2.9.17rc1",
"2.9.18",
"2.9.18rc1",
"2.9.19",
"2.9.19rc1",
"2.9.2",
"2.9.20",
"2.9.20rc1",
"2.9.21",
"2.9.21rc1",
"2.9.22",
"2.9.22rc1",
"2.9.23",
"2.9.23rc1",
"2.9.24",
"2.9.24rc1",
"2.9.25",
"2.9.25rc1",
"2.9.26",
"2.9.26rc1",
"2.9.27rc1",
"2.9.3",
"2.9.4",
"2.9.5",
"2.9.6",
"2.9.7",
"2.9.8",
"2.9.9"
]
}
],
"aliases": [
"CVE-2021-3620",
"GHSA-4r65-35qq-ch8j"
],
"details": "A flaw was found in Ansible Engine\u0027s ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality.",
"id": "PYSEC-2022-164",
"modified": "2022-03-15T14:28:02.422806Z",
"published": "2022-03-03T19:15:00Z",
"references": [
{
"type": "FIX",
"url": "https://github.com/ansible/ansible/commit/fe28767970c8ec62aabe493c46b53a5de1e5fac0"
},
{
"type": "WEB",
"url": "https://github.com/ansible/ansible/blob/stable-2.9/changelogs/CHANGELOG-v2.9.rst#security-fixes"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1975767"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-4r65-35qq-ch8j"
}
]
}
RHSA-2021:3871
Vulnerability from csaf_redhat - Published: 2021-10-14 19:42 - Updated: 2026-01-27 10:42A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-Ansible-2.9:ansible-0:2.9.27-1.el7ae.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-Ansible-2.9:ansible-0:2.9.27-1.el7ae.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-Ansible-2.9:ansible-test-0:2.9.27-1.el7ae.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Ansible-2.9:ansible-0:2.9.27-1.el8ae.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Ansible-2.9:ansible-0:2.9.27-1.el8ae.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Ansible-2.9:ansible-test-0:2.9.27-1.el8ae.noarch | — |
Vendor Fix
fix
|
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for ansible is now available for Ansible Engine 2.9\n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Ansible is a simple model-driven configuration management, multi-node\ndeployment, and remote-task execution system. Ansible works over SSH and\ndoes not require any software or daemons to be installed on remote nodes.\nExtension modules can be written in any language and are transferred to\nmanaged machines automatically.\n\nThe following packages have been upgraded to a newer upstream version:\nansible (2.9.27)\n\nBug Fix(es):\n* CVE-2021-3620 Ansible: ansible-connection module discloses sensitive info\nin traceback error message\n\nSee:\nhttps://github.com/ansible/ansible/blob/v2.9.27/changelogs/CHANGELOG-v2.9.rst\nfor details on bug fixes in this release.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2021:3871",
"url": "https://access.redhat.com/errata/RHSA-2021:3871"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1975767",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1975767"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3871.json"
}
],
"title": "Red Hat Security Advisory: Ansible security and bug fix update (2.9.27)",
"tracking": {
"current_release_date": "2026-01-27T10:42:06+00:00",
"generator": {
"date": "2026-01-27T10:42:06+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.16"
}
},
"id": "RHSA-2021:3871",
"initial_release_date": "2021-10-14T19:42:54+00:00",
"revision_history": [
{
"date": "2021-10-14T19:42:54+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2021-10-14T19:42:54+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-01-27T10:42:06+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Ansible Engine 2.9 for RHEL 7 Server",
"product": {
"name": "Red Hat Ansible Engine 2.9 for RHEL 7 Server",
"product_id": "7Server-Ansible-2.9",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ansible_engine:2.9::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Ansible Engine 2.9 for RHEL 8",
"product": {
"name": "Red Hat Ansible Engine 2.9 for RHEL 8",
"product_id": "8Base-Ansible-2.9",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ansible_engine:2.9::el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat Ansible Engine"
},
{
"branches": [
{
"category": "product_version",
"name": "ansible-0:2.9.27-1.el7ae.src",
"product": {
"name": "ansible-0:2.9.27-1.el7ae.src",
"product_id": "ansible-0:2.9.27-1.el7ae.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ansible@2.9.27-1.el7ae?arch=src"
}
}
},
{
"category": "product_version",
"name": "ansible-0:2.9.27-1.el8ae.src",
"product": {
"name": "ansible-0:2.9.27-1.el8ae.src",
"product_id": "ansible-0:2.9.27-1.el8ae.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ansible@2.9.27-1.el8ae?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "ansible-0:2.9.27-1.el7ae.noarch",
"product": {
"name": "ansible-0:2.9.27-1.el7ae.noarch",
"product_id": "ansible-0:2.9.27-1.el7ae.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ansible@2.9.27-1.el7ae?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "ansible-test-0:2.9.27-1.el7ae.noarch",
"product": {
"name": "ansible-test-0:2.9.27-1.el7ae.noarch",
"product_id": "ansible-test-0:2.9.27-1.el7ae.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ansible-test@2.9.27-1.el7ae?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "ansible-0:2.9.27-1.el8ae.noarch",
"product": {
"name": "ansible-0:2.9.27-1.el8ae.noarch",
"product_id": "ansible-0:2.9.27-1.el8ae.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ansible@2.9.27-1.el8ae?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "ansible-test-0:2.9.27-1.el8ae.noarch",
"product": {
"name": "ansible-test-0:2.9.27-1.el8ae.noarch",
"product_id": "ansible-test-0:2.9.27-1.el8ae.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ansible-test@2.9.27-1.el8ae?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-0:2.9.27-1.el7ae.noarch as a component of Red Hat Ansible Engine 2.9 for RHEL 7 Server",
"product_id": "7Server-Ansible-2.9:ansible-0:2.9.27-1.el7ae.noarch"
},
"product_reference": "ansible-0:2.9.27-1.el7ae.noarch",
"relates_to_product_reference": "7Server-Ansible-2.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-0:2.9.27-1.el7ae.src as a component of Red Hat Ansible Engine 2.9 for RHEL 7 Server",
"product_id": "7Server-Ansible-2.9:ansible-0:2.9.27-1.el7ae.src"
},
"product_reference": "ansible-0:2.9.27-1.el7ae.src",
"relates_to_product_reference": "7Server-Ansible-2.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-test-0:2.9.27-1.el7ae.noarch as a component of Red Hat Ansible Engine 2.9 for RHEL 7 Server",
"product_id": "7Server-Ansible-2.9:ansible-test-0:2.9.27-1.el7ae.noarch"
},
"product_reference": "ansible-test-0:2.9.27-1.el7ae.noarch",
"relates_to_product_reference": "7Server-Ansible-2.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-0:2.9.27-1.el8ae.noarch as a component of Red Hat Ansible Engine 2.9 for RHEL 8",
"product_id": "8Base-Ansible-2.9:ansible-0:2.9.27-1.el8ae.noarch"
},
"product_reference": "ansible-0:2.9.27-1.el8ae.noarch",
"relates_to_product_reference": "8Base-Ansible-2.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-0:2.9.27-1.el8ae.src as a component of Red Hat Ansible Engine 2.9 for RHEL 8",
"product_id": "8Base-Ansible-2.9:ansible-0:2.9.27-1.el8ae.src"
},
"product_reference": "ansible-0:2.9.27-1.el8ae.src",
"relates_to_product_reference": "8Base-Ansible-2.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-test-0:2.9.27-1.el8ae.noarch as a component of Red Hat Ansible Engine 2.9 for RHEL 8",
"product_id": "8Base-Ansible-2.9:ansible-test-0:2.9.27-1.el8ae.noarch"
},
"product_reference": "ansible-test-0:2.9.27-1.el8ae.noarch",
"relates_to_product_reference": "8Base-Ansible-2.9"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Dalton Rardin"
]
}
],
"cve": "CVE-2021-3620",
"cwe": {
"id": "CWE-209",
"name": "Generation of Error Message Containing Sensitive Information"
},
"discovery_date": "2021-06-09T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1975767"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Ansible Engine\u0027s ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Ansible: ansible-connection module discloses sensitive info in traceback error message",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Gluster Storage 3 no longer maintains its own version of Ansible. The prerequisite is to enable the Ansible repository in order to consume the latest version of Ansible, which has many bug and security fixes.\n\nRed Hat Ceph Storage 2 only provides fixes for bugs on an as-requested basis by a customer, and will not be fixed after discussion with engineering about the viability of a fix. Red Hat Ceph Storage 3 does not directly ship ansible, and thus is closed as won\u0027t fix.\n\nRed Hat Virtualization ships an affected version of ansible, however, the usage of ansible on the redhat-virtualization-host is only supported for self-hosted-engine installation and disaster recovery, where it is run locally. As such Impact is rated Moderate.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-Ansible-2.9:ansible-0:2.9.27-1.el7ae.noarch",
"7Server-Ansible-2.9:ansible-0:2.9.27-1.el7ae.src",
"7Server-Ansible-2.9:ansible-test-0:2.9.27-1.el7ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.27-1.el8ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.27-1.el8ae.src",
"8Base-Ansible-2.9:ansible-test-0:2.9.27-1.el8ae.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2021-3620"
},
{
"category": "external",
"summary": "RHBZ#1975767",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1975767"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2021-3620",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-3620"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-3620",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3620"
}
],
"release_date": "2021-06-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-10-14T19:42:54+00:00",
"details": "For details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-Ansible-2.9:ansible-0:2.9.27-1.el7ae.noarch",
"7Server-Ansible-2.9:ansible-0:2.9.27-1.el7ae.src",
"7Server-Ansible-2.9:ansible-test-0:2.9.27-1.el7ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.27-1.el8ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.27-1.el8ae.src",
"8Base-Ansible-2.9:ansible-test-0:2.9.27-1.el8ae.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:3871"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"7Server-Ansible-2.9:ansible-0:2.9.27-1.el7ae.noarch",
"7Server-Ansible-2.9:ansible-0:2.9.27-1.el7ae.src",
"7Server-Ansible-2.9:ansible-test-0:2.9.27-1.el7ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.27-1.el8ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.27-1.el8ae.src",
"8Base-Ansible-2.9:ansible-test-0:2.9.27-1.el8ae.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Ansible: ansible-connection module discloses sensitive info in traceback error message"
}
]
}
RHSA-2021:3872
Vulnerability from csaf_redhat - Published: 2021-10-14 19:43 - Updated: 2026-01-27 10:42A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-Ansible-2:ansible-0:2.9.27-1.el7ae.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-Ansible-2:ansible-0:2.9.27-1.el7ae.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-Ansible-2:ansible-test-0:2.9.27-1.el7ae.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Ansible-2:ansible-0:2.9.27-1.el8ae.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Ansible-2:ansible-0:2.9.27-1.el8ae.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Ansible-2:ansible-test-0:2.9.27-1.el8ae.noarch | — |
Vendor Fix
fix
|
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for ansible is now available for Ansible Engine 2\n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Ansible is a simple model-driven configuration management, multi-node\ndeployment, and remote-task execution system. Ansible works over SSH and\ndoes not require any software or daemons to be installed on remote nodes.\nExtension modules can be written in any language and are transferred to\nmanaged machines automatically.\n\nThe following packages have been upgraded to a newer upstream version:\nansible (2.9.27)\n\nBug Fix(es):\n* CVE-2021-3620 Ansible: ansible-connection module discloses sensitive info\nin traceback error message\n\nSee:\nhttps://github.com/ansible/ansible/blob/v2.9.27/changelogs/CHANGELOG-v2.9.rst\nfor details on bug fixes in this release.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2021:3872",
"url": "https://access.redhat.com/errata/RHSA-2021:3872"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1975767",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1975767"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3872.json"
}
],
"title": "Red Hat Security Advisory: Ansible security and bug fix update (2.9.27)",
"tracking": {
"current_release_date": "2026-01-27T10:42:06+00:00",
"generator": {
"date": "2026-01-27T10:42:06+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.16"
}
},
"id": "RHSA-2021:3872",
"initial_release_date": "2021-10-14T19:43:29+00:00",
"revision_history": [
{
"date": "2021-10-14T19:43:29+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2021-10-14T19:43:29+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-01-27T10:42:06+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Ansible Engine 2 for RHEL 7",
"product": {
"name": "Red Hat Ansible Engine 2 for RHEL 7",
"product_id": "7Server-Ansible-2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ansible_engine:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Ansible Engine 2 for RHEL 8",
"product": {
"name": "Red Hat Ansible Engine 2 for RHEL 8",
"product_id": "8Base-Ansible-2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ansible_engine:2::el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat Ansible Engine"
},
{
"branches": [
{
"category": "product_version",
"name": "ansible-0:2.9.27-1.el7ae.src",
"product": {
"name": "ansible-0:2.9.27-1.el7ae.src",
"product_id": "ansible-0:2.9.27-1.el7ae.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ansible@2.9.27-1.el7ae?arch=src"
}
}
},
{
"category": "product_version",
"name": "ansible-0:2.9.27-1.el8ae.src",
"product": {
"name": "ansible-0:2.9.27-1.el8ae.src",
"product_id": "ansible-0:2.9.27-1.el8ae.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ansible@2.9.27-1.el8ae?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "ansible-0:2.9.27-1.el7ae.noarch",
"product": {
"name": "ansible-0:2.9.27-1.el7ae.noarch",
"product_id": "ansible-0:2.9.27-1.el7ae.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ansible@2.9.27-1.el7ae?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "ansible-test-0:2.9.27-1.el7ae.noarch",
"product": {
"name": "ansible-test-0:2.9.27-1.el7ae.noarch",
"product_id": "ansible-test-0:2.9.27-1.el7ae.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ansible-test@2.9.27-1.el7ae?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "ansible-0:2.9.27-1.el8ae.noarch",
"product": {
"name": "ansible-0:2.9.27-1.el8ae.noarch",
"product_id": "ansible-0:2.9.27-1.el8ae.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ansible@2.9.27-1.el8ae?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "ansible-test-0:2.9.27-1.el8ae.noarch",
"product": {
"name": "ansible-test-0:2.9.27-1.el8ae.noarch",
"product_id": "ansible-test-0:2.9.27-1.el8ae.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ansible-test@2.9.27-1.el8ae?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-0:2.9.27-1.el7ae.noarch as a component of Red Hat Ansible Engine 2 for RHEL 7",
"product_id": "7Server-Ansible-2:ansible-0:2.9.27-1.el7ae.noarch"
},
"product_reference": "ansible-0:2.9.27-1.el7ae.noarch",
"relates_to_product_reference": "7Server-Ansible-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-0:2.9.27-1.el7ae.src as a component of Red Hat Ansible Engine 2 for RHEL 7",
"product_id": "7Server-Ansible-2:ansible-0:2.9.27-1.el7ae.src"
},
"product_reference": "ansible-0:2.9.27-1.el7ae.src",
"relates_to_product_reference": "7Server-Ansible-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-test-0:2.9.27-1.el7ae.noarch as a component of Red Hat Ansible Engine 2 for RHEL 7",
"product_id": "7Server-Ansible-2:ansible-test-0:2.9.27-1.el7ae.noarch"
},
"product_reference": "ansible-test-0:2.9.27-1.el7ae.noarch",
"relates_to_product_reference": "7Server-Ansible-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-0:2.9.27-1.el8ae.noarch as a component of Red Hat Ansible Engine 2 for RHEL 8",
"product_id": "8Base-Ansible-2:ansible-0:2.9.27-1.el8ae.noarch"
},
"product_reference": "ansible-0:2.9.27-1.el8ae.noarch",
"relates_to_product_reference": "8Base-Ansible-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-0:2.9.27-1.el8ae.src as a component of Red Hat Ansible Engine 2 for RHEL 8",
"product_id": "8Base-Ansible-2:ansible-0:2.9.27-1.el8ae.src"
},
"product_reference": "ansible-0:2.9.27-1.el8ae.src",
"relates_to_product_reference": "8Base-Ansible-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-test-0:2.9.27-1.el8ae.noarch as a component of Red Hat Ansible Engine 2 for RHEL 8",
"product_id": "8Base-Ansible-2:ansible-test-0:2.9.27-1.el8ae.noarch"
},
"product_reference": "ansible-test-0:2.9.27-1.el8ae.noarch",
"relates_to_product_reference": "8Base-Ansible-2"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Dalton Rardin"
]
}
],
"cve": "CVE-2021-3620",
"cwe": {
"id": "CWE-209",
"name": "Generation of Error Message Containing Sensitive Information"
},
"discovery_date": "2021-06-09T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1975767"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Ansible Engine\u0027s ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Ansible: ansible-connection module discloses sensitive info in traceback error message",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Gluster Storage 3 no longer maintains its own version of Ansible. The prerequisite is to enable the Ansible repository in order to consume the latest version of Ansible, which has many bug and security fixes.\n\nRed Hat Ceph Storage 2 only provides fixes for bugs on an as-requested basis by a customer, and will not be fixed after discussion with engineering about the viability of a fix. Red Hat Ceph Storage 3 does not directly ship ansible, and thus is closed as won\u0027t fix.\n\nRed Hat Virtualization ships an affected version of ansible, however, the usage of ansible on the redhat-virtualization-host is only supported for self-hosted-engine installation and disaster recovery, where it is run locally. As such Impact is rated Moderate.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-Ansible-2:ansible-0:2.9.27-1.el7ae.noarch",
"7Server-Ansible-2:ansible-0:2.9.27-1.el7ae.src",
"7Server-Ansible-2:ansible-test-0:2.9.27-1.el7ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.27-1.el8ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.27-1.el8ae.src",
"8Base-Ansible-2:ansible-test-0:2.9.27-1.el8ae.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2021-3620"
},
{
"category": "external",
"summary": "RHBZ#1975767",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1975767"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2021-3620",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-3620"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-3620",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3620"
}
],
"release_date": "2021-06-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-10-14T19:43:29+00:00",
"details": "For details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-Ansible-2:ansible-0:2.9.27-1.el7ae.noarch",
"7Server-Ansible-2:ansible-0:2.9.27-1.el7ae.src",
"7Server-Ansible-2:ansible-test-0:2.9.27-1.el7ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.27-1.el8ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.27-1.el8ae.src",
"8Base-Ansible-2:ansible-test-0:2.9.27-1.el8ae.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:3872"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"7Server-Ansible-2:ansible-0:2.9.27-1.el7ae.noarch",
"7Server-Ansible-2:ansible-0:2.9.27-1.el7ae.src",
"7Server-Ansible-2:ansible-test-0:2.9.27-1.el7ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.27-1.el8ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.27-1.el8ae.src",
"8Base-Ansible-2:ansible-test-0:2.9.27-1.el8ae.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Ansible: ansible-connection module discloses sensitive info in traceback error message"
}
]
}
RHSA-2021:3874
Vulnerability from csaf_redhat - Published: 2021-10-14 20:21 - Updated: 2026-01-27 10:42A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-Ansible-Automation-Platform-2.0:ansible-0:2.9.27-1.el8ap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Ansible-Automation-Platform-2.0:ansible-0:2.9.27-1.el8ap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Ansible-Automation-Platform-2.0:ansible-core-0:2.11.6-1.el8ap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Ansible-Automation-Platform-2.0:ansible-core-0:2.11.6-1.el8ap.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Ansible-Automation-Platform-2.0:ansible-test-0:2.11.6-1.el8ap.x86_64 | — |
Vendor Fix
fix
|
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update is now available for Red Hat Ansible Automation Platform 2.0\n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language.\n\nSecurity Fix(es):\n\n* ansible: ansible-connection module discloses sensitive info in traceback error message \n(CVE-2021-3620)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE page(s)\nlisted in the References section.\n\nAdditional Changes:\n\nThis update fixes various bugs and adds enhancements.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2021:3874",
"url": "https://access.redhat.com/errata/RHSA-2021:3874"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1975767",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1975767"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3874.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.0.1 Security and Bug fix Release",
"tracking": {
"current_release_date": "2026-01-27T10:42:07+00:00",
"generator": {
"date": "2026-01-27T10:42:07+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.16"
}
},
"id": "RHSA-2021:3874",
"initial_release_date": "2021-10-14T20:21:23+00:00",
"revision_history": [
{
"date": "2021-10-14T20:21:23+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2021-10-14T20:21:23+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-01-27T10:42:07+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Ansible Automation Platform 2.0 for RHEL 8",
"product": {
"name": "Red Hat Ansible Automation Platform 2.0 for RHEL 8",
"product_id": "8Base-Ansible-Automation-Platform-2.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ansible_automation_platform:2.0::el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat Ansible Automation Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "ansible-0:2.9.27-1.el8ap.src",
"product": {
"name": "ansible-0:2.9.27-1.el8ap.src",
"product_id": "ansible-0:2.9.27-1.el8ap.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ansible@2.9.27-1.el8ap?arch=src"
}
}
},
{
"category": "product_version",
"name": "ansible-core-0:2.11.6-1.el8ap.src",
"product": {
"name": "ansible-core-0:2.11.6-1.el8ap.src",
"product_id": "ansible-core-0:2.11.6-1.el8ap.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ansible-core@2.11.6-1.el8ap?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "ansible-0:2.9.27-1.el8ap.noarch",
"product": {
"name": "ansible-0:2.9.27-1.el8ap.noarch",
"product_id": "ansible-0:2.9.27-1.el8ap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ansible@2.9.27-1.el8ap?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "ansible-core-0:2.11.6-1.el8ap.x86_64",
"product": {
"name": "ansible-core-0:2.11.6-1.el8ap.x86_64",
"product_id": "ansible-core-0:2.11.6-1.el8ap.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ansible-core@2.11.6-1.el8ap?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "ansible-test-0:2.11.6-1.el8ap.x86_64",
"product": {
"name": "ansible-test-0:2.11.6-1.el8ap.x86_64",
"product_id": "ansible-test-0:2.11.6-1.el8ap.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ansible-test@2.11.6-1.el8ap?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-0:2.9.27-1.el8ap.noarch as a component of Red Hat Ansible Automation Platform 2.0 for RHEL 8",
"product_id": "8Base-Ansible-Automation-Platform-2.0:ansible-0:2.9.27-1.el8ap.noarch"
},
"product_reference": "ansible-0:2.9.27-1.el8ap.noarch",
"relates_to_product_reference": "8Base-Ansible-Automation-Platform-2.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-0:2.9.27-1.el8ap.src as a component of Red Hat Ansible Automation Platform 2.0 for RHEL 8",
"product_id": "8Base-Ansible-Automation-Platform-2.0:ansible-0:2.9.27-1.el8ap.src"
},
"product_reference": "ansible-0:2.9.27-1.el8ap.src",
"relates_to_product_reference": "8Base-Ansible-Automation-Platform-2.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-core-0:2.11.6-1.el8ap.src as a component of Red Hat Ansible Automation Platform 2.0 for RHEL 8",
"product_id": "8Base-Ansible-Automation-Platform-2.0:ansible-core-0:2.11.6-1.el8ap.src"
},
"product_reference": "ansible-core-0:2.11.6-1.el8ap.src",
"relates_to_product_reference": "8Base-Ansible-Automation-Platform-2.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-core-0:2.11.6-1.el8ap.x86_64 as a component of Red Hat Ansible Automation Platform 2.0 for RHEL 8",
"product_id": "8Base-Ansible-Automation-Platform-2.0:ansible-core-0:2.11.6-1.el8ap.x86_64"
},
"product_reference": "ansible-core-0:2.11.6-1.el8ap.x86_64",
"relates_to_product_reference": "8Base-Ansible-Automation-Platform-2.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-test-0:2.11.6-1.el8ap.x86_64 as a component of Red Hat Ansible Automation Platform 2.0 for RHEL 8",
"product_id": "8Base-Ansible-Automation-Platform-2.0:ansible-test-0:2.11.6-1.el8ap.x86_64"
},
"product_reference": "ansible-test-0:2.11.6-1.el8ap.x86_64",
"relates_to_product_reference": "8Base-Ansible-Automation-Platform-2.0"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Dalton Rardin"
]
}
],
"cve": "CVE-2021-3620",
"cwe": {
"id": "CWE-209",
"name": "Generation of Error Message Containing Sensitive Information"
},
"discovery_date": "2021-06-09T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1975767"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Ansible Engine\u0027s ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Ansible: ansible-connection module discloses sensitive info in traceback error message",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Gluster Storage 3 no longer maintains its own version of Ansible. The prerequisite is to enable the Ansible repository in order to consume the latest version of Ansible, which has many bug and security fixes.\n\nRed Hat Ceph Storage 2 only provides fixes for bugs on an as-requested basis by a customer, and will not be fixed after discussion with engineering about the viability of a fix. Red Hat Ceph Storage 3 does not directly ship ansible, and thus is closed as won\u0027t fix.\n\nRed Hat Virtualization ships an affected version of ansible, however, the usage of ansible on the redhat-virtualization-host is only supported for self-hosted-engine installation and disaster recovery, where it is run locally. As such Impact is rated Moderate.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Ansible-Automation-Platform-2.0:ansible-0:2.9.27-1.el8ap.noarch",
"8Base-Ansible-Automation-Platform-2.0:ansible-0:2.9.27-1.el8ap.src",
"8Base-Ansible-Automation-Platform-2.0:ansible-core-0:2.11.6-1.el8ap.src",
"8Base-Ansible-Automation-Platform-2.0:ansible-core-0:2.11.6-1.el8ap.x86_64",
"8Base-Ansible-Automation-Platform-2.0:ansible-test-0:2.11.6-1.el8ap.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2021-3620"
},
{
"category": "external",
"summary": "RHBZ#1975767",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1975767"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2021-3620",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-3620"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-3620",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3620"
}
],
"release_date": "2021-06-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-10-14T20:21:23+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Ansible-Automation-Platform-2.0:ansible-0:2.9.27-1.el8ap.noarch",
"8Base-Ansible-Automation-Platform-2.0:ansible-0:2.9.27-1.el8ap.src",
"8Base-Ansible-Automation-Platform-2.0:ansible-core-0:2.11.6-1.el8ap.src",
"8Base-Ansible-Automation-Platform-2.0:ansible-core-0:2.11.6-1.el8ap.x86_64",
"8Base-Ansible-Automation-Platform-2.0:ansible-test-0:2.11.6-1.el8ap.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:3874"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"8Base-Ansible-Automation-Platform-2.0:ansible-0:2.9.27-1.el8ap.noarch",
"8Base-Ansible-Automation-Platform-2.0:ansible-0:2.9.27-1.el8ap.src",
"8Base-Ansible-Automation-Platform-2.0:ansible-core-0:2.11.6-1.el8ap.src",
"8Base-Ansible-Automation-Platform-2.0:ansible-core-0:2.11.6-1.el8ap.x86_64",
"8Base-Ansible-Automation-Platform-2.0:ansible-test-0:2.11.6-1.el8ap.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Ansible: ansible-connection module discloses sensitive info in traceback error message"
}
]
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.