ansible@2.9.10 vulnerabilities

ansible is a simple IT automation system.

Affected versions of this package are vulnerable to Credential Exposure in amazon.aws.ec2_instance, which leaks passwords into logs when tower_callback.windows is set. This was resolved in version 5.1.0 of the amazon.aws.ec2_instance module. Note: You're only vulnerable if you're using the amazon.aws collection

Upgrade ansible to version 7.0.0 or higher.

ansible is a simple IT automation system.

Affected versions of this package are vulnerable to Information Exposure where user credentials are disclosed by default in the traceback error message of set_options.

Upgrade ansible to version 2.9.27 or higher.

ansible is a simple IT automation system.

Affected versions of this package are vulnerable to Command Injection. If a user is trying to put templates in multi-line yaml strings and the facts being handled don't routinely include special template characters, then their controller will be vulnerable to a template injection through the facts used in template.

Upgrade ansible to version 2.9.23 or higher.

ansible is a simple IT automation system.

Affected versions of this package are vulnerable to Information Exposure. Logging with ansible is set at the DEBUG level which lead to a disclosure of credentials if a plugin used a library that logged credentials at the DEBUG level. This flaw does not affect Ansible modules, as those are executed in a separate process.

Upgrade ansible to version 2.9.12, 2.8.6, 2.10.0, 2.7.14 or higher.

ansible is a simple IT automation system.

Affected versions of this package are vulnerable to Information Exposure. In several modules parameters containing credentials are being logged in plain-text on managed nodes, as well as being made visible on the controller node when run in verbose mode. These parameters were not protected by the no_log feature. An attacker can take advantage of this information to steal those credentials, provided they have access to the log files containing them.

Upgrade ansible to version 2.8.20, 2.9.20 or higher.

ansible is a simple IT automation system.

Affected versions of this package are vulnerable to Information Exposure. The return value of a specific module i.e. basic.py of ansible engine is not being masked by default while using the fallback sub-option.The return value may contain sensitive info like secret Or Credentials.

Upgrade ansible to version 2.8.19, 2.9.18, 2.10.7 or higher.

ansible is a simple IT automation system.

Affected versions of this package are vulnerable to Information Exposure. snmp_facts leaks user authentication such as authKey and privKey. This could lead in disclosing those credentials for every user which has access to the output of playbook execution.

Upgrade ansible to version 2.8.19, 2.9.18 or higher.

ansible is a simple IT automation system.

Affected versions of this package are vulnerable to Information Exposure. It leaks sensitive info such as secret values. This could lead in disclosing those credentials for every user which has access to the output of playbook execution.

Upgrade ansible to version 2.8.19, 2.9.18 or higher.

ansible is a simple IT automation system.

Affected versions of this package are vulnerable to Information Exposure. A few different modules in Ansible-collection leaks sensitive data such as secret values. This could lead in disclosing those credentials for every user which has access to the output of playbook execution.

Upgrade ansible to version 2.8.19, 2.9.18 or higher.

ansible is a simple IT automation system.

Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature. A flaw was found in the Ansible Engine when installing packages using the dnf module. GPG signatures are ignored during installation even when disable_gpg_check is set to False, which is the default behaviour. This flaw leads to malicious packages being installed on the system and arbitrary code executed via package installation scripts. The highest threat from this vulnerability is to integrity and system availability.

Upgrade ansible to version 2.8.15, 2.9.13 or higher.

ansible is a simple IT automation system.

Affected versions of this package are vulnerable to Information Exposure. When using uri module keys are not properly masked and sensitive data is exposed into content and json output.

Upgrade ansible to version 2.8.14, 2.9.12 or higher.

ansible is a simple IT automation system.

Affected versions of this package are vulnerable to Information Exposure. When using module_args, tasks executed with check mode (--check-mode) do not properly neutralize sensitive data which would be exposed in the event data. Unauthorized users would be able to read this data.

Upgrade ansible to version 2.8.14, 2.9.12 or higher.