{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2021-20178", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "dateUpdated": "2024-08-03T17:30:07.440Z", "dateReserved": "2020-12-17T00:00:00", "datePublished": "2021-05-26T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2023-12-28T19:06:23.916505"}, "descriptions": [{"lang": "en", "value": "A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucket_pipeline_variable module. This flaw allows an attacker to steal bitbucket_pipeline credentials. The highest threat from this vulnerability is to confidentiality."}], "affected": [{"vendor": "n/a", "product": "Ansible", "versions": [{"version": "before 2.9.18", "status": "affected"}]}], "references": [{"name": "FEDORA-2021-e9478617ae", "tags": ["vendor-advisory"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HIU7QZUV73U6ZQ65VJWSFBTCALVXLH55/"}, {"name": "FEDORA-2021-9a0903469c", "tags": ["vendor-advisory"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FUQ2QKAQA5OW2TY3ACZZMFIAJ2EQTG37/"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1914774"}, {"url": "https://github.com/ansible-collections/community.general/pull/1635%2C"}, {"url": "https://github.com/ansible/ansible/blob/v2.9.18/changelogs/CHANGELOG-v2.9.rst#security-fixes%2C"}, {"name": "[debian-lts-announce] 20231228 [SECURITY] [DLA 3695-1] ansible security update", "tags": ["mailing-list"], "url": "https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html"}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-532", "cweId": "CWE-532"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T17:30:07.440Z"}, "title": "CVE Program Container", "references": [{"name": "FEDORA-2021-e9478617ae", "tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HIU7QZUV73U6ZQ65VJWSFBTCALVXLH55/"}, {"name": "FEDORA-2021-9a0903469c", "tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FUQ2QKAQA5OW2TY3ACZZMFIAJ2EQTG37/"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1914774", "tags": ["x_transferred"]}, {"url": "https://github.com/ansible-collections/community.general/pull/1635%2C", "tags": ["x_transferred"]}, {"url": "https://github.com/ansible/ansible/blob/v2.9.18/changelogs/CHANGELOG-v2.9.rst#security-fixes%2C", "tags": ["x_transferred"]}, {"name": "[debian-lts-announce] 20231228 [SECURITY] [DLA 3695-1] ansible security update", "tags": ["mailing-list", "x_transferred"], "url": "https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html"}]}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*", "matchCriteriaId": "720A73E8-481A-4C14-B06B-7E2D0C1FFAD1", "versionEndExcluding": "2.9.18", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:ansible_tower:3.0:*:*:*:*:*:*:*", "matchCriteriaId": "B31C575C-06D2-4CAF-A5B7-B9469B3ED55F", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*", "matchCriteriaId": "36D96259-24BD-44E2-96D9-78CE1D41F956", "vulnerable": true}, {"criteria": "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*", "matchCriteriaId": "E460AA51-FCDA-46B9-AE97-E6676AA5E194", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucket_pipeline_variable module. This flaw allows an attacker to steal bitbucket_pipeline credentials. The highest threat from this vulnerability is to confidentiality."}, {"lang": "es", "value": "Se encontr\u00f3 un fallo en el m\u00f3dulo ansible donde las credenciales son reveladas en el registro de la consola por defecto y no est\u00e1n protegidas por la caracter\u00edstica de seguridad cuando se usa el m\u00f3dulo bitbucket_pipeline_variable. Este fallo permite a un atacante robar las credenciales del m\u00f3dulo bitbucket_pipeline. La mayor amenaza de esta vulnerabilidad es la confidencialidad"}], "id": "CVE-2021-20178", "lastModified": "2023-12-28T19:15:12.310", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.1, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-05-26T12:15:18.897", "references": [{"source": "secalert@redhat.com", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1914774"}, {"source": "secalert@redhat.com", "url": "https://github.com/ansible-collections/community.general/pull/1635%2C"}, {"source": "secalert@redhat.com", "url": "https://github.com/ansible/ansible/blob/v2.9.18/changelogs/CHANGELOG-v2.9.rst#security-fixes%2C"}, {"source": "secalert@redhat.com", "url": "https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html"}, {"source": "secalert@redhat.com", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FUQ2QKAQA5OW2TY3ACZZMFIAJ2EQTG37/"}, {"source": "secalert@redhat.com", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HIU7QZUV73U6ZQ65VJWSFBTCALVXLH55/"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-532"}], "source": "secalert@redhat.com", "type": "Primary"}]}

{"acknowledgement": "This issue was discovered by Abhijeet Kasurde (Red Hat).", "affected_release": [{"advisory": "RHSA-2021:1079", "cpe": "cpe:/a:redhat:ansible_automation_platform:1.2::el7", "package": "ansible-automation-platform/platform-resource-operator-bundle:v0.1.1-1", "product_name": "Red Hat Ansible Automation Platform 1.2 for RHEL 7", "release_date": "2021-04-09T00:00:00Z"}, {"advisory": "RHSA-2021:1079", "cpe": "cpe:/a:redhat:ansible_automation_platform:1.2::el7", "package": "ansible-automation-platform/platform-resource-rhel7-operator:v0.1.0-12", "product_name": "Red Hat Ansible Automation Platform 1.2 for RHEL 7", "release_date": "2021-04-09T00:00:00Z"}, {"advisory": "RHSA-2021:1079", "cpe": "cpe:/a:redhat:ansible_automation_platform:1.2::el7", "package": "ansible-automation-platform/platform-resource-runner-rhel7:v0.1.0-15", "product_name": "Red Hat Ansible Automation Platform 1.2 for RHEL 7", "release_date": "2021-04-09T00:00:00Z"}, {"advisory": "RHSA-2021:0664", "cpe": "cpe:/a:redhat:ansible_engine:2.9::el7", "package": "ansible-0:2.9.18-1.el7ae", "product_name": "Red Hat Ansible Engine 2.9 for RHEL 7", "release_date": "2021-02-24T00:00:00Z"}, {"advisory": "RHSA-2021:0664", "cpe": "cpe:/a:redhat:ansible_engine:2.9::el8", "package": "ansible-0:2.9.18-1.el8ae", "product_name": "Red Hat Ansible Engine 2.9 for RHEL 8", "release_date": "2021-02-24T00:00:00Z"}, {"advisory": "RHSA-2021:0663", "cpe": "cpe:/a:redhat:ansible_engine:2::el7", "package": "ansible-0:2.9.18-1.el7ae", "product_name": "Red Hat Ansible Engine 2 for RHEL 7", "release_date": "2021-02-24T00:00:00Z"}, {"advisory": "RHSA-2021:0663", "cpe": "cpe:/a:redhat:ansible_engine:2::el8", "package": "ansible-0:2.9.18-1.el8ae", "product_name": "Red Hat Ansible Engine 2 for RHEL 8", "release_date": "2021-02-24T00:00:00Z"}, {"advisory": "RHSA-2021:2180", "cpe": "cpe:/o:redhat:rhev_hypervisor:4.4::el8", "package": "ansible-0:2.9.18-1.el8ae", "product_name": "Red Hat Virtualization 4 for Red Hat Enterprise Linux 8", "release_date": "2021-06-01T00:00:00Z"}, {"advisory": "RHSA-2021:2180", "cpe": "cpe:/a:redhat:rhev_manager:4.4:el8", "package": "ansible-0:2.9.18-1.el8ae", "product_name": "Red Hat Virtualization Engine 4.4", "release_date": "2021-06-01T00:00:00Z"}], "bugzilla": {"description": "ansible: user data leak in snmp_facts module", "id": "1914774", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1914774"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "status": "verified"}, "cwe": "CWE-532", "details": ["A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucket_pipeline_variable module. This flaw allows an attacker to steal bitbucket_pipeline credentials. The highest threat from this vulnerability is to confidentiality.", "A flaw was found in ansible. The 'authkey' and 'privkey' credentials are disclosed by default and not protected by no_log feature when using the snmp_facts module. Attackers could take advantage of this information to steal the SNMP credentials. The highest threat from this vulnerability is to data confidentiality."], "name": "CVE-2021-20178", "package_state": [{"cpe": "cpe:/a:redhat:ansible_tower:3", "fix_state": "Out of support scope", "package_name": "ansible", "product_name": "Red Hat Ansible Tower 3"}, {"cpe": "cpe:/a:redhat:storage:3", "fix_state": "Will not fix", "package_name": "ansible", "product_name": "Red Hat Storage 3"}], "public_date": "2021-01-11T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2021-20178\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-20178"], "statement": "The version of ansible shipped with Red Hat Gluster Storage (RHGS) 3 includes the vulnerable snmp module. However, RHGS 3 no longer maintains its own version of Ansible, prerequisite is to enable ansible repository in order to consume the latest version of ansible which has many bug and security fixes.", "threat_severity": "Moderate", "upstream_fix": "ansible 2.9.18"}