PatchTheCVEansible vulnerabilities and fixes
Recent CVEs affecting ansible, with upgrade or downgrade steps. 14 tracked.
ansible has 14 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 11. Most recent: 2024-02-06. Highest priority: CVE-2021-33924 (score 58/100).
- CVE-2024-0690 MEDIUM 5.0 UPGRADE MITIGATE An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG config
- CVE-2023-5764 HIGH 7.1 UPGRADE DOWNGRADE A template injection flaw was found in Ansible where a user's controller internal templating operations may re
- CVE-2023-32983 MEDIUM 5.3 UPGRADE Jenkins Ansible Plugin 204.v8191fd551eb_f and earlier does not mask extra variables displayed on the configura
- CVE-2023-32982 MEDIUM 4.3 UPGRADE Jenkins Ansible Plugin 204.v8191fd551eb_f and earlier stores extra variables unencrypted in job config.xml fil
- CVE-2022-3697 HIGH 7.5 UPGRADE UPGRADE A flaw was found in Ansible in the amazon.aws collection when using the tower_callback parameter from the amaz
- CVE-2021-3447 MEDIUM 5.5 UPGRADE UPGRADE A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were be
- CVE-2021-33924 CRITICAL 9.8 DOWNGRADE Confluent Ansible (cp-ansible) version 5.5.0, 5.5.1, 5.5.2 and 6.0.0 is vulnerable to Incorrect Access Control
- CVE-2021-20191 MEDIUM 5.5 DOWNGRADE UPGRADE A flaw was found in ansible
- CVE-2021-20180 MEDIUM 5.5 UPGRADE A flaw was found in ansible module where credentials are disclosed in the console log by default and not prote
- CVE-2021-20178 MEDIUM 5.5 UPGRADE DOWNGRADE A flaw was found in ansible module where credentials are disclosed in the console log by default and not prote
- CVE-2020-2310 MEDIUM 4.3 UPGRADE Missing permission checks in Jenkins Ansible Plugin 1.0 and earlier allow attackers with Overall/Read permissi
- CVE-2020-25636 MEDIUM 6.6 DOWNGRADE A flaw was found in Ansible Base when using the aws_ssm connection plugin as there is no namespace separation
- CVE-2020-25635 MEDIUM 5.0 DOWNGRADE A flaw was found in Ansible Base when using the aws_ssm connection plugin as garbage collector is not happenin
- CVE-2019-14904 HIGH 7.3 UPGRADE MITIGATE A flaw was found in the solaris_zone module from the Ansible Community modules
FAQ
How do I fix ansible vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is ansible being exploited right now?
None of the tracked ansible CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which ansible CVE should I patch first?
CVE-2021-33924 currently ranks highest (58/100): Confluent Ansible (cp-ansible) version 5.5.0, 5.5.1, 5.5.2 and 6.0.0 is vulnerable to Incorrect Access Control.