A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucket_pipeline_variable module. This flaw allows an attacker to steal bitbucket_pipeline credentials. The highest threat from this vulnerability is to confidentiality.
CVE-2021-20180 - Medium Severity Vulnerability
Radically simple IT automation
Library home page: https://files.pythonhosted.org/packages/00/5d/e10b83e0e6056dbd5b4809b451a191395175a57e3175ce04e35d9c5fc2a0/ansible-2.9.9.tar.gz
Path to dependency file: /requirements.txt
Path to vulnerable library: /tmp/ws-ua_20241031233445_INZBKI/python_SROAXU/202410312334461/env/lib/python3.8/site-packages/ansible-2.9.9.dist-info
Dependency Hierarchy: - :x: **ansible-2.9.9.tar.gz** (Vulnerable Library)
Found in HEAD commit: 6236f54ea5056f2180727f0a58f05b9a8dd2ee02
Found in base branch: main
A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucket_pipeline_variable module. This flaw allows an attacker to steal bitbucket_pipeline credentials. The highest threat from this vulnerability is to confidentiality.
Publish Date: 2022-03-16
URL: CVE-2021-20180
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://github.com/advisories/GHSA-fh5v-5f35-2rv2
Release Date: 2022-03-16
Fix Resolution: 2.9.18
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.