CVE-2021-20228 Ansible Exposes Sensitive Information
Ansible Engine fails to mask sensitive information in sub-options, allowing attackers to read confidential data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-20228?
CVE-2021-20228 is a high-severity vulnerability in Debian Debian Linux, published on 29 Apr 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in the Ansible Engine 2.9.18, where sensitive info is not masked by default and is not protected by the no_log feature when using the sub-option feature of the basic.py module. This flaw allows an attacker to obtain sensitive information. The highest threat from this vulnerability is to confidentiality.
Weakness: CWE-200
Which versions are affected by CVE-2021-20228?
7 open source packages ship an affected version, including ansible. It affects 4 products.
| Package | Affected | Fixed in |
|---|---|---|
ansible PyPI | All versions | 2.8.19rc1 |
ansible PyPI | All versions | 2.8.19rc1 |
ansible PyPI | All versions | 2.9.19 |
ansible PyPI | From 2.10.0a1 | 2.10.6rc1 |
ansible PyPI | From 2.10.0a1 | 2.10.6rc1 |
ansible PyPI | From 2.9.0a1 | 2.9.18rc1 |
1 more packages
ansible PyPI | From 2.9.0a1 | 2.9.18rc1 |
Products include Debian Debian Linux, Redhat Ansible Automation Platform, Redhat Ansible Engine, Redhat Ansible Tower.
How do I fix CVE-2021-20228?
Upgrade ansible to a fixed version for your release line: 2.8.19rc1, 2.9.19, 2.10.6rc1 or 2.9.18rc1.
Is CVE-2021-20228 being exploited?
There is no known exploitation of CVE-2021-20228 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as AZL-6304, DEBIAN-CVE-2021-20228, GHSA-5rrg-rr89-x9mv, PYSEC-2021-1, UBUNTU-CVE-2021-20228.