PatchTheCVECVE-2021-3620: A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansibl
33
Routine
MEDIUM 5.5WATCHLISTDOWNGRADEUPGRADEDOWNGRADE
CVE-2021-3620 is a medium-severity flaw (CVSS 5.5) affecting ansible automation platform early access, ansible engine, openstack. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality.
Why this priority
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.5 (Medium) |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.4% (top 67%) |
| CISA exploited list | No |
| Weakness | CWE-209 |
| Published | 2022-03-03 |
| Last modified | 2026-06-17 |
Publisher (CNA): Red Hat, Inc. · Vendor: redhat
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
redhat ansible automation platform early access DOWNGRADE
Affected: 2.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 2.0
1. Check installed version
apt-cache policy ansible-automation-platform-early-access || rpm -q ansible-automation-platform-early-access || ansible-automation-platform-early-access --version
2. No fixed release: DOWNGRADE to a release before 2.0 (Debian / Ubuntu)
apt-cache madison ansible-automation-platform-early-access
sudo apt install ansible-automation-platform-early-access=<VERSION_BEFORE_2.0>
sudo apt-mark hold ansible-automation-platform-early-access
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list ansible-automation-platform-early-access
sudo dnf downgrade ansible-automation-platform-early-access-<VERSION_BEFORE_2.0>
sudo dnf versionlock add ansible-automation-platform-early-access
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
redhat ansible engine UPGRADE
Affected: < 2.9.27
Fixed in: 2.9.27
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy ansible-engine || rpm -q ansible-engine || ansible-engine --version
2. UPGRADE to 2.9.27 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade ansible-engine
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade ansible-engine
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
redhat openstack DOWNGRADE
Affected: 1 · 16.1
Fixed in: no fixed release known
Safe to downgrade to: a release before 1
1. Check installed version
apt-cache policy openstack || rpm -q openstack || openstack --version
2. No fixed release: DOWNGRADE to a release before 1 (Debian / Ubuntu)
apt-cache madison openstack
sudo apt install openstack=<VERSION_BEFORE_1>
sudo apt-mark hold openstack
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list openstack
sudo dnf downgrade openstack-<VERSION_BEFORE_1>
sudo dnf versionlock add openstack
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
redhat virtualization DOWNGRADE
Affected: 4.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 4.0
1. Check installed version
apt-cache policy virtualization || rpm -q virtualization || virtualization --version
2. No fixed release: DOWNGRADE to a release before 4.0 (Debian / Ubuntu)
apt-cache madison virtualization
sudo apt install virtualization=<VERSION_BEFORE_4.0>
sudo apt-mark hold virtualization
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list virtualization
sudo dnf downgrade virtualization-<VERSION_BEFORE_4.0>
sudo dnf versionlock add virtualization
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
redhat virtualization for ibm power little endian DOWNGRADE
Affected: 4.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 4.0
1. Check installed version
apt-cache policy virtualization-for-ibm-power-little-endian || rpm -q virtualization-for-ibm-power-little-endian || virtualization-for-ibm-power-little-endian --version
2. No fixed release: DOWNGRADE to a release before 4.0 (Debian / Ubuntu)
apt-cache madison virtualization-for-ibm-power-little-endian
sudo apt install virtualization-for-ibm-power-little-endian=<VERSION_BEFORE_4.0>
sudo apt-mark hold virtualization-for-ibm-power-little-endian
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list virtualization-for-ibm-power-little-endian
sudo dnf downgrade virtualization-for-ibm-power-little-endian-<VERSION_BEFORE_4.0>
sudo dnf versionlock add virtualization-for-ibm-power-little-endian
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
redhat virtualization host DOWNGRADE
Affected: 4.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 4.0
1. Check installed version
apt-cache policy virtualization-host || rpm -q virtualization-host || virtualization-host --version
2. No fixed release: DOWNGRADE to a release before 4.0 (Debian / Ubuntu)
apt-cache madison virtualization-host
sudo apt install virtualization-host=<VERSION_BEFORE_4.0>
sudo apt-mark hold virtualization-host
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list virtualization-host
sudo dnf downgrade virtualization-host-<VERSION_BEFORE_4.0>
sudo dnf versionlock add virtualization-host
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2021-3620?
ansible automation platform early access: downgrade or apply the listed mitigation; ansible engine: upgrade to 2.9.27; openstack: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2021-3620 being exploited?
CVE-2021-3620 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2021-3620 affect?
CVE-2021-3620 affects ansible automation platform early access, ansible engine, openstack. Severity is medium (CVSS 5.5). A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confid
How urgent is CVE-2021-3620?
Priority 33/100. On your watchlist
Software pages
Ansible vulnerabilities · OpenStack vulnerabilities
Related CVEs
- CVE-2021-4112 HIGH 8.8 DOWNGRADE MITIGATE A flaw was found in ansible-tower where the default installation is vulnerable to job isolation escape