Vulnerability Description
A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Redhat | Ansible Automation Platform Early Access | 2.0 |
| Redhat | Ansible Engine | < 2.9.27 |
| Redhat | Openstack | 1 |
| Redhat | Virtualization | 4.0 |
| Redhat | Virtualization For Ibm Power Little Endian | 4.0 |
| Redhat | Virtualization Host | 4.0 |
| Redhat | Virtualization Manager | 4.4 |
| Redhat | Enterprise Linux | 8.0 |
| Redhat | Enterprise Linux For Power Little Endian | 8.0 |
Related Weaknesses (CWE)
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1975767Issue TrackingPatchThird Party Advisory
- https://github.com/ansible/ansible/blob/stable-2.9/changelogs/CHANGELOG-v2.9.rstRelease NotesThird Party Advisory
- https://github.com/ansible/ansible/commit/fe28767970c8ec62aabe493c46b53a5de1e5faPatchThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1975767Issue TrackingPatchThird Party Advisory
- https://github.com/ansible/ansible/blob/stable-2.9/changelogs/CHANGELOG-v2.9.rstRelease NotesThird Party Advisory
- https://github.com/ansible/ansible/commit/fe28767970c8ec62aabe493c46b53a5de1e5faPatchThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html
FAQ
What is CVE-2021-3620?
CVE-2021-3620 is a vulnerability with a CVSS score of 5.5 (MEDIUM). A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest thr...
How severe is CVE-2021-3620?
CVE-2021-3620 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-3620?
Check the references section above for vendor advisories and patch information. Affected products include: Redhat Ansible Automation Platform Early Access, Redhat Ansible Engine, Redhat Openstack, Redhat Virtualization, Redhat Virtualization For Ibm Power Little Endian.