CVE-2021-20191 Insertion of Sensitive Information into Log File in ansible

What is CVE-2021-20191?

CVE-2021-20191 is a medium-severity vulnerability in Redhat Ansible Tower, published on 26 May 2021. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest threat from this vulnerability is to data confidentiality. Versions before ansible 2.9.18 are affected.

Weakness: CWE-532

Which versions are affected by CVE-2021-20191?

7 open source packages ship an affected version, including ansible. It affects 8 products.

Products include Oracle Virtualization, Redhat Ansible, Redhat Ansible Tower, Redhat Cisco Nx-Os Collection, Redhat Community General Collection, Redhat Community Network Collection and 2 more.

How do I fix CVE-2021-20191?

Upgrade ansible to a fixed version for your release line: 2.8.19, 2.9.18, 2.10.7 or 2.8.19rc1.

Is CVE-2021-20191 being exploited?

There is no known exploitation of CVE-2021-20191 in the wild and no public exploit code.

Other vulnerabilities in Redhat Ansible Tower

• CVE-2013-3779 Other in n/a High 7.5
• CVE-2011-3538 Auth bypass in n/a Medium 6.8
• CVE-2015-2581 Other in n/a Medium 6.4
• CVE-2014-2439 Other in n/a Medium 6.4
• CVE-2020-10775 Open redirect in ovirt-engine Medium 5.3

All Redhat Ansible Tower vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2021-20191, CLEANSTART-2026-XW66953, DEBIAN-CVE-2021-20191, GHSA-8f4m-hccc-8qph, PYSEC-2021-124, UBUNTU-CVE-2021-20191.