Red Hat Security AdvisoryRHSA-2021:0664
Ansible security and bug fix update (2.9.18)
Released 2021-02-24 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Ansible Engine 2.9 for RHEL 7 Server ansible-2.9.18-1.el7ae, ansible-test-2.9.18-1.el7ae
- Red Hat Ansible Engine 2.9 for RHEL 8 ansible-2.9.18-1.el8ae, ansible-test-2.9.18-1.el8ae
Fixes 4 records
Priority LOW 37
A flaw was found in the Ansible Engine 2.9.18, where sensitive info is not masked by default and is not protected by the no_log feature when using the sub-option feature of the basic.py module.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02043 · Published 2021-04-29 · Partial fix · 2.10.6rc1, 2.9.18rc1 +1 CWE-200
Priority LOW 25
A flaw was found in ansible.
CVSS 3.1MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.00347 · Published 2021-05-26 · Partial fix · 2.9.18rc1, 2.8.19rc1 +1 CWE-532
Priority LOW 25
A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucket_pipeline_variable module.
CVSS 3.1MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.00314 · Published 2022-03-16 · Partial fix · 2.8.19, 2.9.18 CWE-532
Priority LOW 25
A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucket_pipeline_variable module.
CVSS 3.1MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.00337 · Published 2021-05-26 · Partial fix · 2.9.18 CWE-532
THREATIST.IORead the docs