Search for vulnerabilities
Vulnerability details: VCID-n58m-r94h-dyhh
Vulnerability ID VCID-n58m-r94h-dyhh
Aliases CVE-2021-20191
GHSA-8f4m-hccc-8qph
PYSEC-2021-124
Summary A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest threat from this vulnerability is to data confidentiality. Versions before ansible 2.9.18 are affected.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-532 Insertion of Sensitive Information into Log File
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 5.0 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-20191.json
cvssv3.1 5.5 https://access.redhat.com/security/cve/cve-2021-20191
generic_textual MODERATE https://access.redhat.com/security/cve/cve-2021-20191
epss 0.00026 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00026 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00026 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00026 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00026 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00026 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00026 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00026 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00026 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00026 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00026 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00026 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00026 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00026 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00026 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00026 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00026 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00026 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00026 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00026 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00026 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00026 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00026 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00026 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00026 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00027 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
epss 0.00027 https://api.first.org/data/v1/epss?cve=CVE-2021-20191
cvssv3.1 5.5 https://bugzilla.redhat.com/show_bug.cgi?id=1916813
generic_textual MODERATE https://bugzilla.redhat.com/show_bug.cgi?id=1916813
cvssv3.1 5 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 5.5 https://github.com/advisories/GHSA-8f4m-hccc-8qph
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-8f4m-hccc-8qph
generic_textual MODERATE https://github.com/advisories/GHSA-8f4m-hccc-8qph
cvssv3.1 5.5 https://github.com/ansible/ansible
generic_textual MODERATE https://github.com/ansible/ansible
cvssv3.1 5.5 https://github.com/ansible/ansible/commit/cc82d986c40328d4ae81298a9d287c95a6326bb0
generic_textual MODERATE https://github.com/ansible/ansible/commit/cc82d986c40328d4ae81298a9d287c95a6326bb0
cvssv3.1 5.5 https://github.com/ansible/ansible/commit/d74a1b1d1325af2a24848044cf2858987f5a3ecc
generic_textual MODERATE https://github.com/ansible/ansible/commit/d74a1b1d1325af2a24848044cf2858987f5a3ecc
cvssv3.1 5.5 https://github.com/ansible/ansible/pull/73488
generic_textual MODERATE https://github.com/ansible/ansible/pull/73488
cvssv3.1 5.5 https://github.com/ansible/ansible/pull/73489
generic_textual MODERATE https://github.com/ansible/ansible/pull/73489
cvssv3.1 5.5 https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2021-124.yaml
generic_textual MODERATE https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2021-124.yaml
cvssv3.1 5.5 https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html
generic_textual MODERATE https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html
cvssv2 2.1 https://nvd.nist.gov/vuln/detail/CVE-2021-20191
cvssv3.1 5.5 https://nvd.nist.gov/vuln/detail/CVE-2021-20191
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2021-20191
archlinux Medium https://security.archlinux.org/AVG-1437
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-20191.json
https://access.redhat.com/security/cve/cve-2021-20191
https://api.first.org/data/v1/epss?cve=CVE-2021-20191
https://bugzilla.redhat.com/show_bug.cgi?id=1916813
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20191
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/advisories/GHSA-8f4m-hccc-8qph
https://github.com/ansible/ansible
https://github.com/ansible/ansible/commit/cc82d986c40328d4ae81298a9d287c95a6326bb0
https://github.com/ansible/ansible/commit/d74a1b1d1325af2a24848044cf2858987f5a3ecc
https://github.com/ansible/ansible/pull/73488
https://github.com/ansible/ansible/pull/73489
https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2021-124.yaml
https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html
https://nvd.nist.gov/vuln/detail/CVE-2021-20191
985753 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=985753
ASA-202102-9 https://security.archlinux.org/ASA-202102-9
AVG-1437 https://security.archlinux.org/AVG-1437
cpe:2.3:a:oracle:virtualization:4.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:virtualization:4.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:ansible_tower:3.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:redhat:ansible_tower:3.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:cisco_nx-os_collection:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:redhat:cisco_nx-os_collection:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:community_general_collection:*:*:*:*:*:ansible:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:redhat:community_general_collection:*:*:*:*:*:ansible:*:*
cpe:2.3:a:redhat:community_network_collection:*:*:*:*:*:ansible:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:redhat:community_network_collection:*:*:*:*:*:ansible:*:*
cpe:2.3:a:redhat:docker_community_collection:*:*:*:*:*:ansible:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:redhat:docker_community_collection:*:*:*:*:*:ansible:*:*
cpe:2.3:a:redhat:google_cloud_platform_ansible_collection:1.0.2:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:redhat:google_cloud_platform_ansible_collection:1.0.2:*:*:*:*:*:*:*
RHSA-2021:0663 https://access.redhat.com/errata/RHSA-2021:0663
RHSA-2021:0664 https://access.redhat.com/errata/RHSA-2021:0664
RHSA-2021:1079 https://access.redhat.com/errata/RHSA-2021:1079
RHSA-2021:2180 https://access.redhat.com/errata/RHSA-2021:2180
No exploits are available.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-20191.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://access.redhat.com/security/cve/cve-2021-20191
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://bugzilla.redhat.com/show_bug.cgi?id=1916813
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/advisories/GHSA-8f4m-hccc-8qph
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/ansible/ansible
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/ansible/ansible/commit/cc82d986c40328d4ae81298a9d287c95a6326bb0
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/ansible/ansible/commit/d74a1b1d1325af2a24848044cf2858987f5a3ecc
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/ansible/ansible/pull/73488
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/ansible/ansible/pull/73489
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2021-124.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2021-20191
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2021-20191
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.05666
EPSS Score 0.00026
Published At Aug. 3, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:16:15.458543+00:00 Pypa Importer Import https://github.com/pypa/advisory-database/blob/main/vulns/ansible/PYSEC-2021-124.yaml 37.0.0