Ansible Engine (Redhat) - vulnerabilities (CVEs)

25 CVEs, 0 in the last 30 days, 233 known versions, newest CVE from 2022-03-03. Vendor: Redhat.

CVEs of Ansible Engine

• CVE-2021-3620 - CVSS 5.5 (medium), 2022-03-03: A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in…
• CVE-2021-3583 - CVSS 7.1 (high), 2021-09-22: A flaw was found in Ansible, where a user's controller is vulnerable to template injection. This issue can occur through facts used in the template if the…
• CVE-2020-10729 - CVSS 5.5 (medium), 2021-05-27: A flaw was found in the use of insufficiently random values in Ansible. Two random password lookups of the same length generate the equal value as the…
• CVE-2021-20228 - CVSS 7.5 (high), 2021-04-29: A flaw was found in the Ansible Engine 2.9.18, where sensitive info is not masked by default and is not protected by the no_log feature when using the…
• CVE-2020-14365 - CVSS 7.1 (high), 2020-09-23: A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf…
• CVE-2020-14332 - CVSS 5.5 (medium), 2020-09-11: A flaw was found in the Ansible Engine when using module_args. Tasks executed with check mode (--check-mode) do not properly neutralize sensitive data exposed…
• CVE-2020-14330 - CVSS 5.5 (medium), 2020-09-11: An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content and json output.…
• CVE-2020-1746 - CVSS 5 (medium), 2020-05-12: A flaw was found in the Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible…
• CVE-2020-10685 - CVSS 5.5 (medium), 2020-05-11: A flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible…
• CVE-2020-10691 - CVSS 5.2 (medium), 2020-04-30: An archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running ansible-galaxy collection install. When extracting a…
• CVE-2019-14905 - CVSS 7.3 (high), 2020-03-31: A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible's…
• CVE-2020-1753 - CVSS 5.5 (medium), 2020-03-16: A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prior to 2.8.11 and all Ansible 2.9.x…
• CVE-2020-1737 - CVSS 7.8 (high), 2020-03-09: A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-Zip function from the win_unzip module as the…
• CVE-2020-1734 - CVSS 7.4 (high), 2020-03-03: A flaw was found in the pipe lookup plugin of ansible. Arbitrary commands can be run, when the pipe lookup plugin uses subprocess.Popen() with shell=True, by…
• CVE-2019-14858 - CVSS 7.3 (high), 2019-10-14: A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. When a module has an argument_spec with sub parameters marked as…
• CVE-2019-14846 - CVSS 7.8 (high), 2019-10-08: In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG level which lead…
• CVE-2018-16876 - CVSS 5.3 (medium), 2019-01-03: ansible before versions 2.5.14, 2.6.11, 2.7.5 is vulnerable to a information disclosure flaw in vvv+ mode with no_log on that can lead to leakage of sensible…
• CVE-2018-16859 - CVSS 4.4 (medium), 2018-11-29: Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can allow for 'become' passwords to appear…
• CVE-2018-16837 - CVSS 7.8 (high), 2018-10-23: Ansible "User" module leaks any data which is passed on as a parameter to ssh-keygen. This could lean in undesirable situations such as passphrases…
• CVE-2016-8647 - CVSS 4.9 (medium), 2018-07-26: An input validation vulnerability was found in Ansible's mysql_user module before 2.2.1.0, which may fail to correctly change a password in certain…
• CVE-2017-7481 - CVSS 9.8 (critical), 2018-07-19: Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup()…
• CVE-2018-10875 - CVSS 7.8 (high), 2018-07-13: A flaw was found in ansible. ansible.cfg is read from the current working directory which can be altered to make it point to a plugin or a module path under…
• CVE-2018-10855 - CVSS 5.9 (medium), 2018-07-03: Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect…
• CVE-2018-10874 - CVSS 7.8 (high), 2018-07-02: In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control,…
• CVE-2018-7750 - CVSS 9.8 (critical), 2018-03-13: transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3,…