Ansible Exposes Sensitive Information

高 7.5CVE-2021-20228 · GHSA-5rrg-rr89-x9mv · PYSEC-2021-1 · 29/04/2021 公開 · 17/06/2026 更新

要点

CVE-2021-20228 は ansible, ansible automation platform (redhat), ansible engine (redhat) に影響する深刻度「高」 (CVSS 7.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：2.1%（全脆弱性の 81.3% より高い）。
対処：2.10.6rc1, 2.9.18rc1, 2.8.19rc1, 2.9.19 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
ansible PyPI	`≥ 2.10.0a1, < 2.10.6rc1≥ 2.9.0a1, < 2.9.18rc1< 2.8.19rc1< 2.9.19`	`2.10.6rc12.9.18rc12.8.19rc12.9.19`
ansible automation platform redhat	`= 1.2`	修正版なし
ansible engine redhat	`= 2.0= 2.9= 2.9.18`	修正版なし
ansible tower redhat	`= 3.0`	修正版なし

概要

A flaw was found in the Ansible Engine prior to 2.10.6rc1, 2.9.18rc1, and 2.8.19rc1, where sensitive info is not masked by default and is not protected by the no_log feature when using the sub-option feature of the basic.py module. This flaw allows an attacker to obtain sensitive information. The highest threat from this vulnerability is to confidentiality.

NVD の説明

A flaw was found in the Ansible Engine 2.9.18, where sensitive info is not masked by default and is not protected by the no_log feature when using the sub-option feature of the basic.py module. This flaw allows an attacker to obtain sensitive information. The highest threat from this vulnerability is to confidentiality.