A flaw was found in the Ansible Engine 2.9.18, where sensitive info is not masked by default and is not protected by the no_log feature when using the sub-option feature of the basic.py module. This flaw allows an attacker to obtain sensitive information. The highest threat from this vulnerability is to confidentiality.
References
Link | Resource |
---|---|
https://bugzilla.redhat.com/show_bug.cgi?id=1925002 | Issue Tracking Third Party Advisory |
https://github.com/ansible/ansible/pull/73487 | Patch Third Party Advisory |
https://www.debian.org/security/2021/dsa-4950 | Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: redhat
Published: 2021-04-29T15:34:08
Updated: 2021-08-07T14:06:24
Reserved: 2020-12-17T00:00:00
Link: CVE-2021-20228
JSON object: View
NVD Information
Status : Modified
Published: 2021-04-29T16:15:09.737
Modified: 2023-11-07T03:29:01.053
Link: CVE-2021-20228
JSON object: View
Redhat Information
No data.
CWE