Search for vulnerabilities
Vulnerability details: VCID-a6gj-c3pa-aaad
Vulnerability ID VCID-a6gj-c3pa-aaad
Aliases CVE-2021-20191
GHSA-8f4m-hccc-8qph
PYSEC-2021-124
Summary A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest threat from this vulnerability is to data confidentiality. Versions before ansible 2.9.18 are affected.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-532 Insertion of Sensitive Information into Log File
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
rhas Moderate https://access.redhat.com/errata/RHSA-2021:0663
rhas Moderate https://access.redhat.com/errata/RHSA-2021:0664
rhas Moderate https://access.redhat.com/errata/RHSA-2021:1079
rhas Moderate https://access.redhat.com/errata/RHSA-2021:2180
cvssv3 5.0 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-20191.json
epss 0.00027 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00027 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00081 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
rhbs medium https://bugzilla.redhat.com/show_bug.cgi?id=1916813
cvssv3.1 5 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-8f4m-hccc-8qph
cvssv3.1 5.0 https://github.com/ansible/ansible
generic_textual MODERATE https://github.com/ansible/ansible
cvssv3.1 5.5 https://github.com/ansible/ansible/commit/cc82d986c40328d4ae81298a9d287c95a6326bb0
generic_textual MODERATE https://github.com/ansible/ansible/commit/cc82d986c40328d4ae81298a9d287c95a6326bb0
cvssv3.1 5.5 https://github.com/ansible/ansible/commit/d74a1b1d1325af2a24848044cf2858987f5a3ecc
generic_textual MODERATE https://github.com/ansible/ansible/commit/d74a1b1d1325af2a24848044cf2858987f5a3ecc
cvssv3.1 5.5 https://github.com/ansible/ansible/pull/73488
generic_textual MODERATE https://github.com/ansible/ansible/pull/73488
cvssv3.1 5.5 https://github.com/ansible/ansible/pull/73489
generic_textual MODERATE https://github.com/ansible/ansible/pull/73489
cvssv3.1 5.5 https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2021-124.yaml
generic_textual MODERATE https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2021-124.yaml
cvssv3.1 6.3 https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html
generic_textual MODERATE https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html
cvssv2 2.1 https://nvd.nist.gov/vuln/detail/CVE-2021-20191
cvssv3 5.5 https://nvd.nist.gov/vuln/detail/CVE-2021-20191
cvssv3.1 5.5 https://nvd.nist.gov/vuln/detail/CVE-2021-20191
archlinux Medium https://security.archlinux.org/AVG-1437
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-20191.json
https://api.first.org/data/v1/epss?cve=CVE-2021-20191
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20191
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/ansible/ansible
https://github.com/ansible/ansible/commit/cc82d986c40328d4ae81298a9d287c95a6326bb0
https://github.com/ansible/ansible/commit/d74a1b1d1325af2a24848044cf2858987f5a3ecc
https://github.com/ansible/ansible/pull/73488
https://github.com/ansible/ansible/pull/73489
https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2021-124.yaml
https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html
1916813 https://bugzilla.redhat.com/show_bug.cgi?id=1916813
985753 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=985753
ASA-202102-9 https://security.archlinux.org/ASA-202102-9
AVG-1437 https://security.archlinux.org/AVG-1437
cpe:2.3:a:oracle:virtualization:4.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:virtualization:4.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:ansible_tower:3.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:redhat:ansible_tower:3.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:cisco_nx-os_collection:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:redhat:cisco_nx-os_collection:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:community_general_collection:*:*:*:*:*:ansible:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:redhat:community_general_collection:*:*:*:*:*:ansible:*:*
cpe:2.3:a:redhat:community_network_collection:*:*:*:*:*:ansible:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:redhat:community_network_collection:*:*:*:*:*:ansible:*:*
cpe:2.3:a:redhat:docker_community_collection:*:*:*:*:*:ansible:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:redhat:docker_community_collection:*:*:*:*:*:ansible:*:*
cpe:2.3:a:redhat:google_cloud_platform_ansible_collection:1.0.2:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:redhat:google_cloud_platform_ansible_collection:1.0.2:*:*:*:*:*:*:*
CVE-2021-20191 https://access.redhat.com/security/cve/cve-2021-20191
CVE-2021-20191 https://nvd.nist.gov/vuln/detail/CVE-2021-20191
GHSA-8f4m-hccc-8qph https://github.com/advisories/GHSA-8f4m-hccc-8qph
RHSA-2021:0663 https://access.redhat.com/errata/RHSA-2021:0663
RHSA-2021:0664 https://access.redhat.com/errata/RHSA-2021:0664
RHSA-2021:1079 https://access.redhat.com/errata/RHSA-2021:1079
RHSA-2021:2180 https://access.redhat.com/errata/RHSA-2021:2180
No exploits are available.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-20191.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N Found at https://github.com/ansible/ansible
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/ansible/ansible/commit/cc82d986c40328d4ae81298a9d287c95a6326bb0
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/ansible/ansible/commit/d74a1b1d1325af2a24848044cf2858987f5a3ecc
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/ansible/ansible/pull/73488
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/ansible/ansible/pull/73489
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2021-124.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N Found at https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2021-20191
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2021-20191
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2021-20191
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.05697
EPSS Score 0.00027
Published At June 20, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
There are no relevant records.