Skip to content
OpenAdvisories
High DLA-3695-1 8 CVEs

ansible - security update

Published Dec 28, 2023 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 10 ansible 2.7.7+dfsg-1+deb10u2

Vulnerabilities 8

  • High 7.5
    CVE-2022-3697

    Ansible leaks password to logs

    A flaw was found in Ansible in the amazon.aws collection when using the tower_callback parameter from the amazon.aws.ec2_instance module. This flaw allows an attacker to take advantage of this issue as the module is handling the parameter insecurely, leading …

    ansible ansible ansible ansible-core Debian Ubuntu PyPI
  • High 7.1
    CVE-2021-3583

    Improper Input Validation and Command Injection in Ansible

    A flaw was found in Ansible, where a user's controller is vulnerable to template injection. This issue can occur through facts used in the template if the user is trying to put templates in multi-line YAML strings and the facts being handled do not routinely …

    ansible ansible ansible ansible-core Debian Ubuntu Azure Linux PyPI
  • Medium 6.4
    CVE-2019-10206

    Ansible password prompts could expose passwords

    ansible-playbook -k and ansible cli tools, all versions 2.8.x before 2.8.4, all 2.7.x before 2.7.13 and all 2.6.x before 2.6.19, prompt passwords by expanding them from templates as they could contain special characters. Passwords should be wrapped to prevent…

    Red Hat Ansible ansible ansible Debian Ubuntu Alpine PyPI
  • Medium 6.3
    CVE-2023-5115

    Ansible: malicious role archive can cause ansible-galaxy to overwrite arbitrary files

    An absolute path traversal attack exists in the Ansible automation platform. This flaw allows an attacker to craft a malicious Ansible role and make the victim execute the role. A symlink can be used to overwrite a file outside of the extraction path.

    Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 8 Red Hat Ansible Automation Platform 2.4 for RHEL 9 Red Hat Ansible Automation Platform 1.2 Debian Ubuntu Azure Linux PyPI
  • Medium 5.5
    CVE-2021-20178

    Insertion of Sensitive Information into Log File in ansible

    A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucket_pipeline_variable module. This flaw allows an attacker to steal bitbucket_pipeline credentials.…

    ansible ansible ansible Debian Ubuntu PyPI
  • Medium 5.5
    CVE-2021-20191

    Insertion of Sensitive Information into Log File in ansible

    A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest t…

    ansible ansible ansible ansible Debian Ubuntu Alpine PyPI
  • Medium 5.5
    CVE-2021-3620

    Ansible discloses sensitive information in traceback error message

    A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality.

    ansible ansible ansible ansible-core Debian Ubuntu PyPI
  • Unscored —
    CVE-2021-3447

    A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logge…

    ansible ansible ansible Debian Ubuntu PyPI