Sensitive Data Exposure in Ansible: CVE-2021-20191
Summary
ALPINE-CVE-2021-20191: A flaw was found in ansible. Affects ansible versions < 2.8.19-r0. Fixed in 2.8.19-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ansible is an open-source automation tool that simplifies the management of IT infrastructure through configuration management, application deployment, and task automation. It allows users to define the desired state of their systems using simple, human-readable YAML files. However, a vulnerability has been identified in various versions of Ansible, where sensitive credentials can be inadvertently logged in the console output, exposing them to unauthorized access.
Vulnerability Detail
A flaw was discovered in Ansible that causes sensitive information, such as credentials and secrets, to be disclosed in console logs by default. This occurs when using certain modules that do not implement the 'no_log' feature, which is intended to prevent sensitive data from being logged. The vulnerability affects versions of Ansible prior to 2.9.18, posing a significant risk to data confidentiality. An attacker could exploit this flaw to gain access to sensitive credentials, leading to potential unauthorized actions within the affected systems.
How To Fix
Minimum fixed version
2.8.19-r0
This is the first release that contains the fix.
sudo apk add --upgrade ansibleTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually ensure that sensitive data is not logged by using the 'no_log' directive in their playbooks. For example:
- name: Example task
debug:
msg: 'This message will not be logged'
no_log: true
Conclusion
CVE-2021-20191 represents a significant risk to users of Ansible due to the potential exposure of sensitive credentials in console logs. It is crucial to update to the latest patched versions of Ansible to mitigate this vulnerability and protect data confidentiality.
See every vulnerability recorded for ansible →
FAQ
CVE-2021-20191 is a vulnerability in Ansible that allows sensitive credentials to be logged in the console output, potentially exposing them to unauthorized users.
Versions of Ansible prior to 2.9.18 are affected, with specific fixed versions available for different Alpine Linux releases.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 5.5, indicating a moderate level of severity.
If an immediate update is not possible, ensure that sensitive data is not logged by using the 'no_log' directive in your playbooks.
References
Related vulnerabilities
Recent vulnerabilities recorded for ansible.
