CVE-2021-20178

Name
CVE-2021-20178
Description
A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucket_pipeline_variable module. This flaw allows an attacker to steal bitbucket_pipeline credentials. The highest threat from this vulnerability is to confidentiality.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
MISC https://github.com/ansible/ansible/blob/v2.9.18/changelogs/CHANGELOG-v2.9.rst#security-fixes,
FEDORA https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HIU7QZUV73U6ZQ65VJWSFBTCALVXLH55/
FEDORA https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FUQ2QKAQA5OW2TY3ACZZMFIAJ2EQTG37/
MISC https://bugzilla.redhat.com/show_bug.cgi?id=1914774
MISC https://github.com/ansible-collections/community.general/pull/1635,
secalert@redhat.com https://github.com/ansible-collections/community.general/pull/1635%2C
secalert@redhat.com https://github.com/ansible/ansible/blob/v2.9.18/changelogs/CHANGELOG-v2.9.rst#security-fixes%2C
secalert@redhat.com https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html
secalert@redhat.com https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FUQ2QKAQA5OW2TY3ACZZMFIAJ2EQTG37/
secalert@redhat.com https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HIU7QZUV73U6ZQ65VJWSFBTCALVXLH55/

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:* ansible >= None < 2.9.18
cpe:2.3:a:redhat:ansible_tower:3.0:*:*:*:*:*:*:* ansible_tower == None == 3.0

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
ansible 3.10-main 2.8.19-r0 Fabian Affolter <fabian@affolter-engineering.ch> possibly vulnerable