Credential Disclosure Vulnerability in Ansible Package
Summary
CVE-2021-20180: A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucket_pipeline_variable module. Affects ansible across 2 version ranges.
< 2.10.7-1
< 4455e60166a8271771d96c24f47b6714130d200f
Fixed in 2.10.7-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ansible is an open-source automation tool that simplifies the management of IT infrastructure through configuration management, application deployment, and task automation. It allows users to define the desired state of their systems using simple YAML files. However, a vulnerability has been identified in the ansible module, specifically in the bitbucket_pipeline_variable module, which can lead to the unintentional exposure of sensitive credentials in console logs.
Vulnerability Detail
A flaw was found in the ansible module where credentials are disclosed in the console log by default and are not protected by security features when using the bitbucket_pipeline_variable module. This vulnerability allows an attacker to potentially steal Bitbucket pipeline credentials, posing a significant threat to confidentiality. The issue arises from improper handling of sensitive information, leading to its exposure in logs that can be accessed by unauthorized users.
How To Fix
Minimum fixed version
2.10.7-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade ansibleTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually filter out sensitive information from console logs or redirect logs to a secure location where unauthorized access is restricted. However, this is not a permanent solution and upgrading the package is strongly recommended.
Conclusion
The CVE-2021-20180 vulnerability in the Ansible package poses a significant risk by exposing sensitive credentials in console logs. Users are advised to upgrade to the latest version to mitigate this risk. Implementing temporary workarounds can help, but upgrading is the best long-term solution.
See every vulnerability recorded for ansible →
FAQ
CVE-2021-20180 is a vulnerability in the Ansible package that allows credentials to be disclosed in console logs, potentially exposing sensitive information.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 5.5, indicating a moderate level of risk.
If an immediate upgrade is not possible, consider implementing a temporary workaround by filtering sensitive information from logs or securing log access.
More information can be found in the official CVE database or through security advisories related to Ansible.
Related vulnerabilities
Recent vulnerabilities recorded for ansible.
