{"id":"CVE-2021-20178","published":"2021-05-26T00:00:00Z","modified":"2024-08-03T17:30:07Z","title":"A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by…","vendor":null,"product":null,"tier":"tail","description":{"text":"A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucket_pipeline_variable module. This flaw allows an attacker to steal bitbucket_pipeline credentials. The highest threat from this vulnerability is to confidentiality.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.0034,"percentile":0.27338,"provenance":"source"},"cwes":[{"id":"CWE-532","name":"Insertion of Sensitive Information into Log File"}],"references":[{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HIU7QZUV73U6ZQ65VJWSFBTCALVXLH55/","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FUQ2QKAQA5OW2TY3ACZZMFIAJ2EQTG37/","tags":["vendor-advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1914774","tags":[]},{"url":"https://github.com/ansible-collections/community.general/pull/1635%2C","tags":[]},{"url":"https://github.com/ansible/ansible/blob/v2.9.18/changelogs/CHANGELOG-v2.9.rst#security-fixes%2C","tags":[]},{"url":"https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html","tags":["mailing-list"]}],"priority":{"score":5.5,"factors":[{"name":"EPSS percentile","points":5.47}]},"affectedVersions":[{"vendor":"n/a","product":"Ansible","versions":["before 2.9.18"]}],"affected":[{"ecosystem":"PyPI","package":"ansible","vulnerableRanges":["<2.9.18"],"patched":["2.9.18"],"from":["GHSA-wv5p-gmmv-wh9v","PYSEC-2021-106"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-0006","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-ansible-cve-2021-20178","packageHistory":[{"cve":"CVE-2020-1753","published":"2020-03-16","fixed":"2.9.7","kev":false},{"cve":"CVE-2020-1735","published":"2020-03-16","fixed":"2.9.8","kev":false},{"cve":"CVE-2020-14365","published":"2020-09-23","fixed":"2.9.14rc1","kev":false},{"cve":"CVE-2021-20178","published":"2021-05-26","fixed":"2.9.18","kev":false},{"cve":"CVE-2021-20180","published":"2022-03-16","fixed":"2.9.18","kev":false},{"cve":"CVE-2021-3620","published":"2022-03-03","fixed":"2.9.27","kev":false},{"cve":"CVE-2020-10744","published":"2020-05-15","fixed":"2.10.0rc1","kev":false},{"cve":"CVE-2021-20191","published":"2021-05-26","fixed":"2.10.7","kev":false,"link":{"from":"CVE-2021-20191","to":"CVE-2021-20178","relation":"successor","confidence":"medium","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:ansible","fromFixed":"2.9.18rc1","toFixed":"2.9.18","daysApart":0},{"kind":"similar","provenance":"machine","score":0.5,"basis":"same package + description similarity"}]}}],"package":"PyPI:ansible"}}