CVE-2021-3620

NameCVE-2021-3620
DescriptionA flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3695-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
ansible (PTS)jessie, jessie (lts)1.7.2+dfsg-2+deb8u3vulnerable
stretch (security), stretch (lts), stretch2.2.1.0-2+deb9u3vulnerable
buster (security), buster, buster (lts)2.7.7+dfsg-1+deb10u2fixed
bullseye2.10.7+merged+base+2.10.17+dfsg-0+deb11u1fixed
bookworm7.7.0+dfsg-3+deb12u1fixed
sid, trixie10.5.0+dfsg-2fixed
ansible-core (PTS)bookworm2.14.16-0+deb12u1fixed
sid, trixie2.17.5-4fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
ansiblesourcestretch(unfixed)end-of-life
ansiblesourcebuster2.7.7+dfsg-1+deb10u2DLA-3695-1
ansiblesourcebullseye2.10.7+merged+base+2.10.17+dfsg-0+deb11u1
ansiblesource(unstable)5.4.0-1
ansible-basesource(unstable)(unfixed)
ansible-coresource(unstable)2.12.0-1

Notes

[stretch] - ansible <end-of-life> (EOL'd for stretch)
https://bugzilla.redhat.com/show_bug.cgi?id=1975767
https://github.com/ansible/ansible/commit/79e9dae29212a88aa60122ca6bd608947399017f
ansible-core was split off from src:ansible with 4.6.0-1 in experimental/5.4.0-1 in sid

Search for package or bug name: Reporting problems