CVE-2021-20180 (Medium) detected in ansible-2.9.9.tar.gz

[staging-whitesource-for-github-com[bot]]

CVE-2021-20180 - Medium Severity Vulnerability

Vulnerable Library - ansible-2.9.9.tar.gz

Radically simple IT automation

Library home page: https://files.pythonhosted.org/packages/00/5d/e10b83e0e6056dbd5b4809b451a191395175a57e3175ce04e35d9c5fc2a0/ansible-2.9.9.tar.gz

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy: - :x: **ansible-2.9.9.tar.gz** (Vulnerable Library)

Found in HEAD commit: 468a9043c4298813feaf94da51c858f22aad8291

Found in base branch: main

Vulnerability Details

A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucket_pipeline_variable module. This flaw allows an attacker to steal bitbucket_pipeline credentials. The highest threat from this vulnerability is to confidentiality.

Publish Date: 2022-03-16

URL: CVE-2021-20180

CVSS 3 Score Details (5.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-fh5v-5f35-2rv2

Release Date: 2022-03-16

Fix Resolution: 2.9.18

---

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.

[staging-whitesource-for-github-com[bot]]

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

[staging-whitesource-for-github-com[bot]]

:information_source: This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.