CVE-2021-3620

NameCVE-2021-3620
DescriptionA flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
ansible (PTS)buster, buster (security)2.7.7+dfsg-1+deb10u1vulnerable
bullseye2.10.7+merged+base+2.10.8+dfsg-1vulnerable
bookworm, sid7.0.0+dfsg-1fixed
ansible-core (PTS)bookworm2.13.4-1fixed
sid2.14.0-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
ansiblesourcestretch(unfixed)end-of-life
ansiblesource(unstable)5.4.0-1
ansible-basesource(unstable)(unfixed)
ansible-coresource(unstable)2.12.0-1

Notes

[bullseye] - ansible <postponed> (Minor issue, revisit when/if fixed upstream)
[buster] - ansible <postponed> (Minor issue, revisit when/if fixed upstream)
[stretch] - ansible <end-of-life> (EOL'd for stretch)
https://bugzilla.redhat.com/show_bug.cgi?id=1975767
https://github.com/ansible/ansible/commit/79e9dae29212a88aa60122ca6bd608947399017f
ansible-core was split off from src:ansible with 4.6.0-1 in experimental/5.4.0-1 in sid

Search for package or bug name: Reporting problems