CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NCVE-2021-20228
High (7.5). EPSS 2.1% chance of exploitation in the next 30 days. Fixed in ansible 2.10.6rc1, 2.8.19rc1, 2.9.18rc1.
A flaw was found in the Ansible Engine 2.9.18, where sensitive info is not masked by default and is not protected by the no_log feature when using the sub-option feature of the basic.py module. This flaw allows an attacker to obtain sensitive information. The highest threat from this vulnerability is to confidentiality.
Severity
- EPSS
- 2.1% chance of exploitation in the next 30 days; higher than 81% of CVEs (scores of 2026-10-31)
- CWE
- CWE-200
- Published
- Modified
- Record from
- the NVD, synced
Affected
- debian:debian_linux
- redhat:ansible_automation_platform
- redhat:ansible_engine
- redhat:ansible_tower
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-5rrg-rr89-x9mv | PyPI | ansible | >=2.10.0a1 <2.10.6rc1 | 2.10.6rc1 |
| GHSA-5rrg-rr89-x9mv | PyPI | ansible | >=2.9.0a1 <2.9.18rc1 | 2.9.18rc1 |
| GHSA-5rrg-rr89-x9mv | PyPI | ansible | <2.8.19rc1 | 2.8.19rc1 |
| PYSEC-2021-1 | PyPI | ansible | <2.9.19 | 2.9.19 |