CVE-2021-20228
Fixed in a distro release EPSS 2%
A flaw was found in the Ansible Engine 2.9.18, where sensitive info is not masked by default and is not protected by the no_log feature when using the sub-option feature of the basic.py module. This flaw allows an attacker to obtain sensitive information. The highest threat from this vulnerability is to confidentiality.
Products: redhat ansible_engine, redhat ansible_automation_platform, redhat ansible_tower, debian_linux
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | ansible | 2.10.6rc1 |
| PyPI | ansible | 2.9.18rc1 |
| PyPI | ansible | 2.8.19rc1 |
| PyPI | ansible | 2.9.19 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 10 | ansible | 2.7.7+dfsg-1+deb10u1 |
| Debian 12 | ansible | 2.10.7+merged+base+2.10.8+dfsg-1 |
| Debian 13 | ansible | 2.10.7+merged+base+2.10.8+dfsg-1 |
| Debian 14 | ansible | 2.10.7+merged+base+2.10.8+dfsg-1 |
| Red Hat ansible engine 2 | ansible | 0:2.9.18-1.el7ae |
| Red Hat ansible engine 2 | ansible | 0:2.9.18-1.el8ae |
| Red Hat ansible engine 2 | ansible-test | 0:2.9.18-1.el7ae |
| Red Hat ansible engine 2 | ansible-test | 0:2.9.18-1.el8ae |
| Red Hat ansible engine 2.9 | ansible | 0:2.9.18-1.el8ae |
| Red Hat ansible engine 2.9 | ansible | 0:2.9.18-1.el7ae |
| Red Hat ansible engine 2.9 | ansible-test | 0:2.9.18-1.el8ae |
| Red Hat ansible engine 2.9 | ansible-test | 0:2.9.18-1.el7ae |
| Red Hat rhev hypervisor 4.4 | ansible | 0:2.9.18-1.el8ae |
| Red Hat rhev manager 4.4 el8 | ansible | 0:2.9.18-1.el8ae |
| SUSE HPE Helion OpenStack 8 | ansible | 2.9.22-3.18.1 |
| SUSE Linux Enterprise High Performance Computing 15-ESPOS | golang-github-prometheus-node_exporter | 1.3.0-150000.3.15.1 |
| SUSE Linux Enterprise High Performance Computing 15-LTSS | golang-github-prometheus-node_exporter | 1.3.0-150000.3.15.1 |
| SUSE Linux Enterprise Server 15-LTSS | golang-github-prometheus-node_exporter | 1.3.0-150000.3.15.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 | golang-github-prometheus-node_exporter | 1.3.0-150000.3.15.1 |
| SUSE Manager Client Tools 15 | ansible | 2.9.27-150000.1.14.1 |
| SUSE Manager Client Tools 15 | dracut-saltboot | 0.1.1657643023.0d694ce-150000.1.35.1 |
| SUSE Manager Client Tools 15 | golang-github-QubitProducts-exporter_exporter | 0.4.0-150000.1.15.1 |
| SUSE Manager Client Tools 15 | mgr-daemon | 4.3.5-150000.1.35.1 |
| SUSE Manager Client Tools 15 | mgr-virtualization | 4.3.6-150000.1.32.1 |
| SUSE Manager Client Tools 15 | prometheus-blackbox_exporter | 0.19.0-150000.1.11.1 |
| SUSE Manager Client Tools 15 | python-hwdata | 2.3.5-150000.3.9.1 |
| SUSE Manager Client Tools 15 | spacecmd | 4.3.14-150000.3.83.1 |
| SUSE Manager Client Tools 15 | spacewalk-client-tools | 4.3.11-150000.3.65.1 |
| SUSE Manager Client Tools 15 | uyuni-common-libs | 4.3.5-150000.1.24.1 |
| SUSE Manager Client Tools 15 | uyuni-proxy-systemd-services | 4.3.6-150000.1.6.1 |
| SUSE Manager Client Tools 15 | zypp-plugin-spacewalk | 1.0.13-150000.3.32.1 |
| SUSE Manager Client Tools 15-BETA | ansible | 2.9.27-159000.3.9.1 |
| SUSE Manager Client Tools 15-BETA | dracut-saltboot | 0.1.1681904360.84ef141-159000.3.30.1 |
| SUSE Manager Client Tools 15-BETA | golang-github-QubitProducts-exporter_exporter | 0.4.0-159000.4.6.1 |
| SUSE Manager Client Tools 15-BETA | golang-github-boynux-squid_exporter | 1.6-159000.4.9.1 |
| SUSE Manager Client Tools 15-BETA | golang-github-lusitaniae-apache_exporter | 1.0.0-159000.4.12.1 |
| SUSE Manager Client Tools 15-BETA | golang-github-prometheus-prometheus | 2.45.0-159000.6.33.1 |
| SUSE Manager Client Tools 15-BETA | grafana | 9.5.8-159000.4.24.1 |
| SUSE Manager Client Tools 15-BETA | mgr-push | 5.0.1-159000.4.21.1 |
| SUSE Manager Client Tools 15-BETA | prometheus-blackbox_exporter | 0.24.0-159000.3.6.1 |
| SUSE Manager Client Tools 15-BETA | prometheus-postgres_exporter | 0.10.1-159000.3.6.1 |
| SUSE Manager Client Tools 15-BETA | python-hwdata | 2.3.5-159000.5.13.1 |
| SUSE Manager Client Tools 15-BETA | python-pyvmomi | 6.7.3-159000.3.6.1 |
| SUSE Manager Client Tools 15-BETA | rhnlib | 5.0.1-159000.6.30.1 |
| SUSE Manager Client Tools 15-BETA | spacecmd | 5.0.1-159000.6.42.1 |
| SUSE Manager Client Tools 15-BETA | spacewalk-client-tools | 5.0.1-159000.6.48.1 |
| SUSE Manager Client Tools 15-BETA | supportutils-plugin-salt | 1.2.2-159000.5.9.1 |
| SUSE Manager Client Tools 15-BETA | supportutils-plugin-susemanager-client | 5.0.1-159000.6.15.1 |
| SUSE Manager Client Tools 15-BETA | uyuni-common-libs | 5.0.1-159000.3.33.1 |
| SUSE Manager Client Tools 15-BETA | uyuni-proxy-systemd-services | 5.0.1-159000.3.9.1 |
| SUSE Manager Client Tools Beta for SLE Micro 5 | dracut-saltboot | 0.1.1681904360.84ef141-159000.3.30.1 |
| SUSE Manager Client Tools Beta for SLE Micro 5 | golang-github-QubitProducts-exporter_exporter | 0.4.0-159000.4.6.1 |
| SUSE Manager Client Tools Beta for SLE Micro 5 | prometheus-blackbox_exporter | 0.24.0-159000.3.6.1 |
| SUSE Manager Client Tools Beta for SLE Micro 5 | uyuni-proxy-systemd-services | 5.0.1-159000.3.9.1 |
| SUSE Manager Proxy Module 4.1 | python-hwdata | 2.3.5-150000.3.9.1 |
| SUSE Manager Proxy Module 4.1 | zypp-plugin-spacewalk | 1.0.13-150000.3.32.1 |
| SUSE Manager Proxy Module 4.2 | ansible | 2.9.27-150000.1.14.1 |
| SUSE Manager Proxy Module 4.2 | golang-github-QubitProducts-exporter_exporter | 0.4.0-150000.1.15.1 |
| SUSE Manager Proxy Module 4.2 | prometheus-blackbox_exporter | 0.19.0-150000.1.11.1 |
| SUSE Manager Proxy Module 4.2 | python-hwdata | 2.3.5-150000.3.9.1 |
| SUSE Manager Proxy Module 4.2 | zypp-plugin-spacewalk | 1.0.13-150000.3.32.1 |
| SUSE Manager Proxy Module 4.3 | ansible | 2.9.27-150000.1.14.1 |
| SUSE Manager Proxy Module 4.3 | golang-github-QubitProducts-exporter_exporter | 0.4.0-150000.1.15.1 |
| SUSE Manager Proxy Module 4.3 | prometheus-blackbox_exporter | 0.19.0-150000.1.11.1 |
| SUSE Manager Proxy Module 4.3 | python-hwdata | 2.3.5-150000.3.9.1 |
| SUSE Manager Proxy Module 4.3 | zypp-plugin-spacewalk | 1.0.13-150000.3.32.1 |
| SUSE Manager Server Module 4.1 | python-hwdata | 2.3.5-150000.3.9.1 |
| SUSE Manager Server Module 4.2 | golang-github-QubitProducts-exporter_exporter | 0.4.0-150000.1.15.1 |
| SUSE Manager Server Module 4.2 | python-hwdata | 2.3.5-150000.3.9.1 |
| SUSE Manager Server Module 4.3 | golang-github-QubitProducts-exporter_exporter | 0.4.0-150000.1.15.1 |
| SUSE Manager Server Module 4.3 | python-hwdata | 2.3.5-150000.3.9.1 |
| SUSE OpenStack Cloud 8 | ansible | 2.9.22-3.18.1 |
| SUSE OpenStack Cloud Crowbar 8 | ansible | 2.9.22-3.18.1 |
| SUSE Package Hub 15 SP3 | ansible | 2.9.21-bp153.2.3.1 |
| Ubuntu 24.04 LTS | ansible | no fix |
| Ubuntu 25.10 | ansible | no fix |
| Ubuntu 26.04 LTS | ansible | no fix |
| Ubuntu 26.10 | ansible | no fix |
| Ubuntu Pro 14.04 LTS | ansible | no fix |
| Ubuntu Pro 16.04 LTS | ansible | no fix |
| Ubuntu Pro 18.04 LTS | ansible | no fix |
| Ubuntu Pro 20.04 LTS | ansible | no fix |
| Ubuntu Pro 22.04 LTS | ansible | no fix |
| openSUSE Leap 15.3 | ansible | 2.9.21-bp153.2.3.1 |
| openSUSE Leap 15.3 | ansible | 2.9.27-150000.1.14.1 |
| openSUSE Leap 15.3 | dracut-saltboot | 0.1.1657643023.0d694ce-150000.1.35.1 |
| openSUSE Leap 15.3 | golang-github-QubitProducts-exporter_exporter | 0.4.0-150000.1.15.1 |
| openSUSE Leap 15.3 | python-hwdata | 2.3.5-150000.3.9.1 |
| openSUSE Leap 15.3 | spacecmd | 4.3.14-150000.3.83.1 |
| openSUSE Leap 15.4 | ansible | 2.9.27-150000.1.14.1 |
| openSUSE Leap 15.4 | dracut-saltboot | 0.1.1657643023.0d694ce-150000.1.35.1 |
| openSUSE Leap 15.4 | golang-github-QubitProducts-exporter_exporter | 0.4.0-150000.1.15.1 |
| openSUSE Leap 15.4 | prometheus-blackbox_exporter | 0.19.0-150000.1.11.1 |
| openSUSE Leap 15.4 | python-hwdata | 2.3.5-150000.3.9.1 |
| openSUSE Leap 15.4 | spacecmd | 4.3.14-150000.3.83.1 |
| openSUSE Leap 15.4 | wire | 0.5.0-150000.1.6.1 |
| openSUSE Tumbleweed | ansible-10 | 10.6.0-1.1 |
| openSUSE Tumbleweed | ansible-11 | 11.11.0-1.1 |
| openSUSE Tumbleweed | ansible-12 | 12.2.0-1.1 |
| openSUSE Tumbleweed | ansible-13 | 13.7.0-1.1 |
| openSUSE Tumbleweed | ansible-9 | 9.8.0-1.1 |