CVE-2021-3620

NameCVE-2021-3620
DescriptionA flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
ansible (PTS)buster, buster (security)2.7.7+dfsg-1+deb10u1vulnerable
bullseye2.10.7+merged+base+2.10.8+dfsg-1vulnerable
bookworm, sid5.5.0-1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
ansiblesourcestretch(unfixed)end-of-life
ansiblesource(unstable)(unfixed)
ansible-basesource(unstable)(unfixed)

Notes

[bullseye] - ansible <postponed> (Minor issue, revisit when/if fixed upstream)
[buster] - ansible <postponed> (Minor issue, revisit when/if fixed upstream)
[stretch] - ansible <end-of-life> (EOL'd for stretch)
https://bugzilla.redhat.com/show_bug.cgi?id=1975767

Search for package or bug name: Reporting problems