Vulnerability · Published Mar 3, 2022 · Assigned by redhat
CVE-2021-3620
Medium 5.5
In plain English
A medium-severity security flaw in ansible. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)5.5Medium
Exploit odds (30 days)0.4%top 66.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | ansible | 5.4.0-1 | DEBIAN-CVE-2021-3620 |
| Debian:13 | ansible | 5.4.0-1 | DEBIAN-CVE-2021-3620 |
| Debian:14 | ansible | 5.4.0-1 | DEBIAN-CVE-2021-3620 |
| Debian:12 | ansible-core | 2.12.0-1 | DEBIAN-CVE-2021-3620 |
| Debian:13 | ansible-core | 2.12.0-1 | DEBIAN-CVE-2021-3620 |
| Debian:14 | ansible-core | 2.12.0-1 | DEBIAN-CVE-2021-3620 |
| PyPI | ansible | 2.9.27 | GHSA-4r65-35qq-ch8j |
| PyPI | ansible | 2.9.27 | PYSEC-2022-164 |
| Ubuntu:24.04:LTS | ansible | no fix listed | UBUNTU-CVE-2021-3620 |
| Ubuntu:25.10 | ansible | no fix listed | UBUNTU-CVE-2021-3620 |
| Ubuntu:26.04:LTS | ansible | no fix listed | UBUNTU-CVE-2021-3620 |
| Ubuntu:26.10 | ansible | no fix listed | UBUNTU-CVE-2021-3620 |
Affected products (as reported)
Weakness: CWE-209
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1975767 x_refsource_MISC
- https://github.com/ansible/ansible/blob/stable-2.9/changelogs/CHANGELOG-v2.9.rst#security-fixes x_refsource_MISC
- https://github.com/ansible/ansible/commit/fe28767970c8ec62aabe493c46b53a5de1e5fac0 x_refsource_MISC
- https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html