CVE-2021-3620

Description

A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality.

How to fix CVE-2021-3620

To remediate CVE-2021-3620, upgrade the affected package to a fixed version below.

• —upgrade to 2.10.7+merged+base+2.10.17+dfsg-0+deb11u1 or later
• —upgrade to 2.12.0-1 or later
• —upgrade to 2.9.27 or later
• —upgrade to fe28767970c8ec62aabe493c46b53a5de1e5fac0 or later

Is CVE-2021-3620 being exploited?

Low — EPSS is 0.3%, meaning exploitation activity has not been observed at scale.

Affected packages (4)

• from 0, < 2.10.7+merged+base+2.10.17+dfsg-0+deb11u1
• from 0, < 2.12.0-1
• from 0, < 2.9.27
• from 0, < fe28767970c8ec62aabe493c46b53a5de1e5fac0 | from 0, < 2.9.27

CVSS scores

References (15)

• ADVISORYgithub.com/advisories/GHSA-4r65-35qq-ch8j
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2021-3620
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2021-3620
• PATCHgithub.com/ansible/ansible
• WEB