The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:3744 advisory.

    Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task     execution system. Ansible works over SSH and does not require any software or daemons to be installed on     remote nodes. Extension modules can be written in any language and are transferred to managed machines     automatically.

    Security Fix(es):

    * Ansible: path traversal in the fetch module (CVE-2019-3828)

    * ansible: unsafe template evaluation of returned module data can lead to information disclosure     (CVE-2019-10156)

    * Ansible: disclosure data when prompted for password and template characters are passed (CVE-2019-10206)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:3789 advisory.

    Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task     execution system. Ansible works over SSH and does not require any software or daemons to be installed on     remote nodes. Extension modules can be written in any language and are transferred to managed machines     automatically.

    Security Fix(es):

    * Ansible: path traversal in the fetch module (CVE-2019-3828)

    * ansible: unsafe template evaluation of returned module data can lead to information disclosure     (CVE-2019-10156)

    * Ansible: disclosure data when prompted for password and template characters are passed (CVE-2019-10206)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:2542 advisory.

    Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task     execution system. Ansible works over SSH and does not require any software or daemons to be installed on     remote nodes. Extension modules can be written in any language and are transferred to managed machines     automatically.

    The following packages have been upgraded to a newer upstream version: ansible (2.8.4)

    Security fix(es):

    * Ansible: data disclosure when a password from the prompt contains template characters (CVE-2019-10206)
    * Ansible: gcp modules do not flag sensitive data fields properly (CVE-2019-10217)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    For details on bug fixes in this release see:

    https://github.com/ansible/ansible/blob/v2.8.4/changelogs/CHANGELOG-v2.8.rst

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:2543 advisory.

    Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task     execution system. Ansible works over SSH and does not require any software or daemons to be installed on     remote nodes. Extension modules can be written in any language and are transferred to managed machines     automatically.

    The following packages have been upgraded to a newer upstream version: ansible (2.8.4)

    Security fix(es):

    * Ansible: data disclosure when a password from the prompt contains template characters (CVE-2019-10206)
    * Ansible: gcp modules do not flag sensitive data fields properly (CVE-2019-10217)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    For details on bug fixes in this release see:

    https://github.com/ansible/ansible/blob/v2.8.4/changelogs/CHANGELOG-v2.8.rst

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2019:2544 advisory.

    Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task     execution system. Ansible works over SSH and does not require any software or daemons to be installed on     remote nodes. Extension modules can be written in any language and are transferred to managed machines     automatically.

    The following packages have been upgraded to a newer upstream version: ansible (2.7.13)

    Security fix(es):

    * Ansible: data disclosure when a password from the prompt contains template characters (CVE-2019-10206)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the ansible package has been released.

This update for ansible to version 2.9.6 fixes the following issues :

Security issues fixed :

  - CVE-2019-14904: Fixed a vulnerability in solaris_zone     module via crafted solaris zone (boo#1157968).

  - CVE-2019-14905: Fixed an issue where malicious code     could craft filename in nxos_file_copy module     (boo#1157969).

  - CVE-2019-14864: Fixed Splunk and Sumologic callback     plugins leak sensitive data in logs (boo#1154830).

  - CVE-2019-14846: Fixed secrets disclosure on logs due to     display is hardcoded to DEBUG level (boo#1153452)

  - CVE-2019-14856: Fixed insufficient fix for     CVE-2019-10206 (boo#1154232)

  - CVE-2019-14858: Fixed data in the sub parameter fields     that will not be masked and will be displayed when run     with increased verbosity (boo#1154231) 

  - CVE-2019-10206: ansible-playbook -k and ansible cli     tools prompt passwords by expanding them from templates     as they could contain special characters. Passwords     should be wrapped to prevent templates trigger and     exposing them. (boo#1142690)

  - CVE-2019-10217: Fields managing sensitive data should be     set as such by no_log feature. Some of these fields in     GCP modules are not set properly.
    service_account_contents() which is common class for all     gcp modules is not setting no_log to True. Any sensitive     data managed by that function would be leak as an output     when running ansible playbooks. (boo#1144453)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7330-1 advisory.

    It was discovered that Ansible did not properly verify certain fields of X.509 certificates. An attacker     could possibly use this issue to spoof SSL servers if they were able to intercept network communications.
    This issue only affected Ubuntu 14.04 LTS. (CVE-2015-3908)

    Martin Carpenter discovered that certain connection plugins for Ansible did not properly restrict users.
    An attacker with local access could possibly use this issue to escape a restricted environment via     symbolic links misuse. This issue only affected Ubuntu 14.04 LTS. (CVE-2015-6240)

    Robin Schneider discovered that Ansible's apt_key module did not properly verify key fingerprints. A     remote attacker could possibly use this issue to perform key injection, leading to the access of sensitive     information. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-8614)

    It was discovered that Ansible would expose passwords in certain instances. An attacker could possibly use     specially crafted input related to this issue to access sensitive information. This issue only affected     Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-10206)

    It was discovered that Ansible incorrectly logged sensitive information. An attacker with local access     could possibly use this issue to access sensitive information. This issue only affected Ubuntu 14.04 LTS,     Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2019-14846)

    It was discovered that Ansible's solaris_zone module accepted input without performing input checking. A     remote attacker could possibly use this issue to enable the execution of arbitrary code. This issue only     affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-14904)

    It was discovered that Ansible did not generate sufficiently random values, which could lead to the     exposure of passwords. An attacker could possibly use this issue to access sensitive information. This     issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2020-10729)

    It was discovered that Ansible's svn module could disclose passwords to users within the same node. An     attacker could possibly use this issue to access sensitive information. (CVE-2020-1739)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

2.8.4 update with various bugfixes. Also Fixes CVE-2019-10217 and CVE-2019-10206

----

New 2.8.3 upstream bugfix release.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2019:2545 advisory.

    Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task     execution system. Ansible works over SSH and does not require any software or daemons to be installed on     remote nodes. Extension modules can be written in any language and are transferred to managed machines     automatically.

    The following packages have been upgraded to a newer upstream version: ansible (2.6.19)

    Security fix(es):

    * Ansible: data disclosure when a password from the prompt contains template characters (CVE-2019-10206)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-4950 advisory.

    Several vulnerabilities have been found in Ansible, a configuration management, deployment and task     execution system, which could result in information disclosure or argument injection. In addition a race     condition in become_user was fixed. For the stable distribution (buster), these problems have been fixed     in version 2.7.7+dfsg-1+deb10u1. We recommend that you upgrade your ansible packages. For the detailed     security status of ansible please refer to its security tracker page at: https://security-     tracker.debian.org/tracker/ansible

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3695 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3695-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Bastien Roucaris     December 28, 2023                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : ansible     Version        : 2.7.7+dfsg-1+deb10u2     CVE ID         : CVE-2019-10206 CVE-2021-3447 CVE-2021-3583 CVE-2021-3620                      CVE-2021-20178 CVE-2021-20191 CVE-2022-3697 CVE-2023-5115     Debian Bug     : 1053693

    Ansible a configuration management, deployment, and task execution system     was affected by multiple vulnerabilities.

    CVE-2019-10206

        Fix a regression in test suite of CVE-2019-10206.

    CVE-2021-3447

        A flaw was found in several         ansible modules, where parameters containing credentials,         such as secrets, were being logged in plain-text on         managed nodes, as well as being made visible on the         controller node when run in verbose mode. These parameters         were not protected by the no_log feature. An attacker can         take advantage of this information to steal those credentials,         provided when they have access to the log files         containing them. The highest threat from this vulnerability         is to data confidentiality

    CVE-2021-3583

        A flaw was found in Ansible, where         a user's controller is vulnerable to template injection.
        This issue can occur through facts used in the template         if the user is trying to put templates in multi-line YAML         strings and the facts being handled do not routinely         include special template characters. This flaw allows         attackers to perform command injection, which discloses         sensitive information. The highest threat from this         vulnerability is to confidentiality and integrity.

    CVE-2021-3620

        A flaw was found in Ansible Engine's         ansible-connection module, where sensitive information         such as the Ansible user credentials is disclosed by         default in the traceback error message. The highest         threat from this vulnerability is to confidentiality.

    CVE-2021-20178

        A flaw was found in ansible module         snmp_fact where credentials are disclosed in the console log by         default and not protected by the security feature         This flaw allows an attacker to steal privkey and authkey         credentials. The highest threat from this vulnerability         is to confidentiality.

    CVE-2021-20191

        A flaw was found in ansible. Credentials,         such as secrets, are being disclosed in console log by default         and not protected by no_log feature when using Cisco nxos moduel.
        An attacker can take advantage of this information to steal those         credentials. The highest threat from this vulnerability is         to data confidentiality.

    CVE-2022-3697

        A flaw was found in Ansible in the amazon.aws         collection when using the tower_callback parameter from the         amazon.aws.ec2_instance module. This flaw allows an attacker         to take advantage of this issue as the module is handling the         parameter insecurely, leading to the password leaking in the logs.

    CVE-2023-5115

        An absolute path traversal attack existed         in the Ansible automation platform. This flaw allows an         attacker to craft a malicious Ansible role and make the         victim execute the role. A symlink can be used to         overwrite a file outside of the extraction path.

    For Debian 10 buster, these problems have been fixed in version     2.7.7+dfsg-1+deb10u2.

    We recommend that you upgrade your ansible packages.

    For the detailed security status of ansible please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/ansible

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
193826	RHEL 7 : ansible (RHSA-2019:3744)	Nessus	Red Hat Local Security Checks	4/24/2024	11/7/2024	medium
194100	RHEL 7 : ansible (RHSA-2019:3789)	Nessus	Red Hat Local Security Checks	4/27/2024	11/7/2024	medium
128107	RHEL 7 / 8 : Ansible (RHSA-2019:2542)	Nessus	Red Hat Local Security Checks	8/23/2019	11/6/2024	medium
193993	RHEL 7 / 8 : Ansible (RHSA-2019:2543)	Nessus	Red Hat Local Security Checks	4/27/2024	11/6/2024	medium
128108	RHEL 7 : Ansible (RHSA-2019:2544)	Nessus	Red Hat Local Security Checks	8/23/2019	11/6/2024	medium
135298	Photon OS 2.0: Ansible PHSA-2020-2.0-0226	Nessus	PhotonOS Local Security Checks	4/10/2020	7/22/2024	high
135454	openSUSE Security Update : ansible (openSUSE-2020-513)	Nessus	SuSE Local Security Checks	4/14/2020	3/19/2024	high
232217	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS : Ansible vulnerabilities (USN-7330-1)	Nessus	Ubuntu Local Security Checks	3/6/2025	3/6/2025	high
128431	Fedora 30 : ansible (2019-01e86d4832)	Nessus	Fedora Local Security Checks	9/3/2019	4/30/2024	medium
128109	RHEL 7 : Ansible (RHSA-2019:2545)	Nessus	Red Hat Local Security Checks	8/23/2019	11/7/2024	medium
135779	Photon OS 3.0: Ansible PHSA-2020-3.0-0078	Nessus	PhotonOS Local Security Checks	4/21/2020	7/24/2024	high
152270	Debian DSA-4950-1 : ansible - security update	Nessus	Debian Local Security Checks	8/7/2021	1/24/2025	high
214484	Debian dla-3695 : ansible - security update	Nessus	Debian Local Security Checks	1/22/2025	1/22/2025	high

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

high

high

high

medium

medium

high

high

high