ansible@2.9.17rc1 vulnerabilities

Radically simple IT automation

latest version

11.1.0

latest non vulnerable version

first published

11 years ago

latest version published

19 days ago

licenses detected

GPL-3.0
[0,)

View ansible package health on Snyk Advisor (opens in a new tab)

Go back to all versions of this package

Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the ansible package. This does not include vulnerabilities belonging to this package’s dependencies.

How to fix?

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

Vulnerability	Vulnerable Version
M Credential Exposure ansible is a simple IT automation system. Affected versions of this package are vulnerable to Credential Exposure in `amazon.aws.ec2_instance`, which leaks passwords into logs when `tower_callback.windows` is set. This was resolved in version 5.1.0 of the `amazon.aws.ec2_instance` module. Note: You're only vulnerable if you're using the `amazon.aws` collection How to fix Credential Exposure? Upgrade `ansible` to version 7.0.0 or higher.	[2.5.0,7.0.0)
M Information Exposure ansible is a simple IT automation system. Affected versions of this package are vulnerable to Information Exposure where user credentials are disclosed by default in the traceback error message of `set_options`. How to fix Information Exposure? Upgrade `ansible` to version 2.9.27 or higher.	[,2.9.27)
M Command Injection ansible is a simple IT automation system. Affected versions of this package are vulnerable to Command Injection. If a user is trying to put templates in multi-line yaml strings and the facts being handled don't routinely include special template characters, then their controller will be vulnerable to a template injection through the facts used in template. How to fix Command Injection? Upgrade `ansible` to version 2.9.23 or higher.	[,2.9.23)
M Information Exposure ansible is a simple IT automation system. Affected versions of this package are vulnerable to Information Exposure. In several modules parameters containing credentials are being logged in plain-text on managed nodes, as well as being made visible on the controller node when run in verbose mode. These parameters were not protected by the `no_log` feature. An attacker can take advantage of this information to steal those credentials, provided they have access to the log files containing them. How to fix Information Exposure? Upgrade `ansible` to version 2.8.20, 2.9.20 or higher.	[0,2.8.20)[2.9.0,2.9.20)
M Information Exposure ansible is a simple IT automation system. Affected versions of this package are vulnerable to Information Exposure. It leaks sensitive info such as secret values. This could lead in disclosing those credentials for every user which has access to the output of playbook execution. How to fix Information Exposure? Upgrade `ansible` to version 2.8.19, 2.9.18 or higher.	[,2.8.19)[2.9.0,2.9.18)
M Information Exposure ansible is a simple IT automation system. Affected versions of this package are vulnerable to Information Exposure. The return value of a specific module i.e. `basic.py` of ansible engine is not being masked by default while using the fallback `sub-option`.The return value may contain sensitive info like secret Or Credentials. How to fix Information Exposure? Upgrade `ansible` to version 2.8.19, 2.9.18, 2.10.7 or higher.	[,2.8.19)[2.9.0,2.9.18)[2.10.0,2.10.7)
M Information Exposure ansible is a simple IT automation system. Affected versions of this package are vulnerable to Information Exposure. `snmp_facts` leaks user authentication such as `authKey` and `privKey`. This could lead in disclosing those credentials for every user which has access to the output of playbook execution. How to fix Information Exposure? Upgrade `ansible` to version 2.8.19, 2.9.18 or higher.	[,2.8.19)[2.9.0,2.9.18)
M Information Exposure ansible is a simple IT automation system. Affected versions of this package are vulnerable to Information Exposure. A few different modules in Ansible-collection leaks sensitive data such as secret values. This could lead in disclosing those credentials for every user which has access to the output of playbook execution. How to fix Information Exposure? Upgrade `ansible` to version 2.8.19, 2.9.18 or higher.	[,2.8.19)[2.9.0,2.9.18)

Go back to all versions of this package