Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

ansible

67 known vulnerabilities (11 high, 23 medium, 6 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
67 · 11 high, 23 medium, 6 low
Registry
PyPI

Advisories 67

  • CVE-2025-14010Medium 5.5

    Ansible-collection-community-general: ansible-collection-community-general: keycloak user module leaks credentials in verbose output

    Affected: fixed in 12.2.0.

  • CVE-2023-5115Medium 6.3

    Ansible: malicious role archive can cause ansible-galaxy to overwrite arbitrary files

    Affected: fixed in 8.5.0.

  • A flaw was found in Ansible in the amazon.aws collection when using the tower_callback parameter from the amazon.aws.ec2_instance module.

    Affected: from 2.5.0, fixed in 7.0.0.

  • A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature…

    Affected: from 2.8.0a1, fixed in 2.8.19; from 2.9.0b1, fixed in 2.9.18; from 2.8.0a1, fixed in 2.8.19; from 2.9.0b1, fixed in 2.9.18.

  • A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is…

    Affected: fixed in 2.9.27.

  • A flaw was found in Ansible, where a user's controller is vulnerable to template injection.

    Affected: fixed in 2.9.23rc1; from 2.10.0a1, fixed in 2.10.11rc1; from 2.11.0a1, fixed in 2.11.2rc1; fixed in 2.9.23.

  • A flaw was found in the use of insufficiently random values in Ansible.

    Affected: fixed in 2.9.6.

  • A flaw was found in ansible.

    Affected: fixed in 2.8.19; from 2.9.0, fixed in 2.9.18; from 2.10.0, fixed in 2.10.7; from 2.9.0a1, fixed in 2.9.18rc1; fixed in 2.8.19rc1; from 2.10.0a1, fixed in 2.10.7.

  • A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature…

    Affected: fixed in 2.9.18.

  • A flaw was found in the Ansible Engine 2.9.18, where sensitive info is not masked by default and is not protected by the no_log feature…

    Affected: from 2.10.0a1, fixed in 2.10.6rc1; from 2.9.0a1, fixed in 2.9.18rc1; fixed in 2.8.19rc1; fixed in 2.9.19.

  • A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged in plain-text on…

    Affected: fixed in 1.2.2.

  • CVE-2020-25635Medium 5.0

    A flaw was found in Ansible Base when using the aws_ssm connection plugin as garbage collector is not happening after playbook run is…

    Affected: fixed in 2.10.1.

  • A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing…

    Affected: from 2.8.0a1, fixed in 2.8.15; from 2.9.0a1, fixed in 2.9.13; from 2.8.0, fixed in 2.8.16rc1; from 2.9.0, fixed in 2.9.14rc1.

  • CVE-2020-14332Medium 5.5

    A flaw was found in the Ansible Engine when using module_args.

    Affected: fixed in 2.8.14; from 2.9.0a1, fixed in 2.9.12; from 2.10.0a1, fixed in 2.10.1rc2; from 2.8.0, fixed in 2.8.14; from 2.9.0, fixed in 2.9.12.

  • CVE-2020-14330Medium 5.0

    An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content…

    Affected: fixed in 2.10.0; fixed in 2.10.0.

Show all 67 advisoriesShow fewer advisories

  • A flaw was found in the solaris_zone module from the Ansible Community modules.

    Affected: fixed in 2.7.16; from 2.8.0a1, fixed in 2.8.8; from 2.9.0a1, fixed in 2.9.3; fixed in 2.7.15; from 2.8.0, fixed in 2.8.7; from 2.9.0, fixed in 2.9.2.

  • CVE-2020-10744Medium 5.0

    An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running become_user from…

    Affected: from 2.10.0a1, fixed in 2.10.0rc1; fixed in 2.9.12; from 2.7.0, fixed in 2.8.0a1; from 2.8.0, fixed in 2.8.13; from 2.9.0, fixed in 2.9.10.

  • CVE-2020-1746Medium 5.0

    A flaw was found in the Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before…

    Affected: from 2.7.0, fixed in 2.7.17; from 2.8.0, fixed in 2.8.11; from 2.9.0, fixed in 2.9.7; from 2.8.0a1, fixed in 2.8.11; from 2.9.0a1, fixed in 2.9.7; from 2.7.0a1, fixed in 2.7.17.

  • CVE-2020-10685Medium 5.0

    A flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as…

    Affected: from 2.7.0, fixed in 2.7.17; from 2.8.0, fixed in 2.8.11; from 2.9.0, fixed in 2.9.7; from 2.7.0a1, fixed in 2.7.17; from 2.8.0a1, fixed in 2.8.11; from 2.9.0a1, fixed in 2.9.7.

  • CVE-2020-10691Medium 5.2

    An archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running ansible-galaxy collection install.

    Affected: from 2.9.0, fixed in 2.9.7; from 2.9.0a1, fixed in 2.9.7.

  • A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in…

    Affected: from 2.7.0, fixed in 2.7.16; from 2.8.0, fixed in 2.8.8; from 2.9.0, fixed in 2.9.3; from 2.7.0a1, fixed in 2.7.16; from 2.8.0a1, fixed in 2.8.8; from 2.9.0a1, fixed in 2.9.3.

  • A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, when using…

    Affected: from 2.7.0, fixed in 2.7.17; from 2.8.0, fixed in 2.8.9; from 2.9.0, fixed in 2.9.6; from 2.7.0a1, fixed in 2.7.17; from 2.8.0a1, fixed in 2.8.11; from 2.9.0a1, fixed in 2.9.7.

  • A flaw was found in Ansible Engine when the module package or service is used and the parameter 'use' is not specified.

    Affected: fixed in 2.7.17; from 2.8.0, fixed in 2.8.9; from 2.9.0, fixed in 2.9.6; through 2.7.16; from 2.8.0a1, through 2.8.10; from 2.9.0a1, through 2.9.6.

  • A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files.

    Affected: fixed in 2.7.17; from 2.8.0a1, fixed in 2.8.11; from 2.9.0a1, fixed in 2.9.7; fixed in 2.7.17; from 2.8.0, fixed in 2.8.9; from 2.9.0, fixed in 2.9.6.

  • CVE-2020-1735Medium 4.2

    A flaw was found in the Ansible Engine when the fetch module is used.

    Affected: fixed in 2.7.17; from 2.8.0, fixed in 2.8.9; from 2.9.0, fixed in 2.9.6; from 2.7.0a1, fixed in 2.7.18; from 2.8.0a1, fixed in 2.8.12; from 2.9.0a1, fixed in 2.9.8.

  • A flaw was found in Ansible Engine when a file is moved using atomic_move primitive as the file mode cannot be specified.

    Affected: from 2.7.0, through 2.10.0; fixed in 2.7.17; from 2.8.0, fixed in 2.8.9; from 2.9.0, fixed in 2.9.6.

  • CVE-2020-1753Medium 5.0

    A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prior to 2.8.11 and…

    Affected: fixed in 2.7.18; from 2.8.0, fixed in 2.8.11; from 2.9.0, fixed in 2.9.7; from 2.7.0a1, fixed in 2.7.18; from 2.8.0a1, fixed in 2.8.12; from 2.9.0a1, fixed in 2.9.7.

  • A flaw was found in Ansible 2.7.16 and prior, 2.8.8 and prior, and 2.9.5 and prior when a password is set with the argument "password" of…

    Affected: fixed in 2.7.17; from 2.8.0, fixed in 2.8.9; from 2.9.0, fixed in 2.9.6; fixed in 2.7.17; from 2.8.0a1, fixed in 2.8.11; from 2.9.0a1, fixed in 2.9.7.

  • CVE-2020-1733Medium 5.0

    A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a playbook with an…

    Affected: fixed in 2.7.17; from 2.8.0, fixed in 2.8.8; from 2.9.0, fixed in 2.9.6; fixed in 2.7.17; from 2.8.0a1, fixed in 2.8.11; from 2.9.0a1, fixed in 2.9.7.

  • A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-Zip function from the win_unzip…

    Affected: from 2.8.0a1, fixed in 2.8.9; from 2.9.0a1, fixed in 2.9.6; fixed in 2.7.17; fixed in 2.7.17; from 2.8.0, fixed in 2.8.9; from 2.9.0, fixed in 2.9.6.

  • A flaw was found in the pipe lookup plugin of ansible.

    Affected: from 2.10.0a1, fixed in 2.10.0rc1; from 2.9.0a1, fixed in 2.9.11; fixed in 2.8.13; fixed in 2.7.17.

  • Ansible before 1.5.5 sets 0644 permissions for sources.list, which might allow local users to obtain sensitive credential information in…

    Affected: fixed in 1.5.5.

  • The vault subsystem in Ansible before 1.5.5 does not set the umask before creation or modification of a vault file, which allows local…

    Affected: fixed in 1.5.5.

  • The safe_eval function in Ansible before 1.5.4 does not properly restrict the code subset, which allows remote attackers to execute…

    Affected: fixed in 1.5.4.

  • The safe_eval function in Ansible before 1.6.4 does not properly restrict the code subset, which allows remote attackers to execute…

    Affected: fixed in 1.6.4; fixed in 1.6.4.

  • Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in sources.list, which might allow…

    Affected: fixed in 1.5.5; fixed in 1.5.5.

  • Multiple argument injection vulnerabilities in Ansible before 1.6.7 allow remote attackers to execute arbitrary code by leveraging access…

    Affected: fixed in 1.6.7; fixed in 1.6.7.

  • Ansible before 1.6.7 does not prevent inventory data with "{{" and "lookup" substrings, and does not prevent remote data with "{{"…

    Affected: fixed in 1.6.7; fixed in 1.6.7.

  • Ansible prior to 1.5.4 mishandles the evaluation of some strings.

    Affected: fixed in 1.5.4.

  • CVE-2019-14864Medium 5.7

    Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set…

    Affected: from 2.7.0, fixed in 2.7.15; from 2.8.0, fixed in 2.8.7; from 2.9.0, fixed in 2.9.1; from 2.7.0a1, fixed in 2.7.15; from 2.8.0a1, fixed in 2.8.7; from 2.9.0a1, fixed in 2.9.1.

  • CVE-2019-14856Medium 6.4

    ansible before versions 2.8.6, 2.7.14, 2.6.20 is vulnerable to a None

    Affected: from 2.6.0, fixed in 2.6.20; from 2.7.0, fixed in 2.7.14; from 2.8.0, fixed in 2.8.6; from 2.8.0, fixed in 2.8.6; from 2.7.0, fixed in 2.7.14; from 2.6.0, fixed in 2.6.20.

  • CVE-2019-10217Medium 5.7

    A flaw was found in ansible 2.8.0 before 2.8.4.

    Affected: from 2.8.0, fixed in 2.8.4; from 2.8.0a1, fixed in 2.8.4.

  • CVE-2019-10206Medium 6.4

    ansible-playbook -k and ansible cli tools, all versions 2.8.x before 2.8.4, all 2.7.x before 2.7.13 and all 2.6.x before 2.6.19, prompt…

    Affected: from 2.6.0, fixed in 2.6.19; from 2.7.0, fixed in 2.7.13; from 2.8.0, fixed in 2.8.4; from 2.8.0, fixed in 2.8.4; from 2.7.0, fixed in 2.7.13; from 2.6.0, fixed in 2.6.19.

  • A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5.

    Affected: from 2.9.0a1, fixed in 2.9.0rc4; from 2.8.0a1, fixed in 2.8.6; from 2.7.0a1, fixed in 2.7.14; from 2.0, fixed in 2.6.20; from 2.0, fixed in 2.8.1.

  • In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the…

    Affected: fixed in 2.6.20; from 2.7.0, fixed in 2.7.14; from 2.8.0, fixed in 2.8.6; fixed in 2.6.20; from 2.7.0a1, fixed in 2.7.14; from 2.8.0a1, fixed in 2.8.6.

  • CVE-2019-10156Medium 4.6

    A flaw was discovered in the way Ansible templating was implemented in versions before 2.6.18, 2.7.12 and 2.8.2, causing the possibility…

    Affected: fixed in 2.6.18; from 2.7.0a1, fixed in 2.7.12; from 2.8.0a1, fixed in 2.8.2; fixed in 2.6.18; from 2.7.0, fixed in 2.7.12; from 2.8.0, fixed in 2.8.2.

  • CVE-2019-3828Medium 4.2

    Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files…

    Affected: from 2.5.0, fixed in 2.5.15; from 2.6.0, fixed in 2.6.14; from 2.7.0, fixed in 2.7.8; fixed in 2.5.15; from 2.6.0a1, fixed in 2.6.14; from 2.7.0a1, fixed in 2.7.8.

  • ansible before versions 2.5.14, 2.6.11, 2.7.5 is vulnerable to a information disclosure flaw in vvv+ mode with no_log on that can lead to…

    Affected: fixed in 2.5.14; from 2.6.0a1, fixed in 2.6.11; from 2.7.0a1, fixed in 2.7.5; from 2.5.0, fixed in 2.5.14; from 2.6.0, fixed in 2.6.11; from 2.7.0, fixed in 2.7.5.

  • CVE-2018-16859Medium 4.2

    Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can allow for 'become'…

    Affected: from 2.7.0, fixed in 2.7.4; from 2.7.5, fixed in 2.8.1; fixed in 2.5.13; from 2.6.0, fixed in 2.6.10; from 2.7.0a1, fixed in 2.7.3; fixed in 2.5.12; from 2.6.0a1, fixed in 2.6.9.

  • Ansible "User" module leaks any data which is passed on as a parameter to ssh-keygen.

    Affected: from 2.7.0a1, fixed in 2.7.1; from 2.6.0a1, fixed in 2.6.7; fixed in 2.5.11; from 2.7, fixed in 2.7.1; from 2.6, fixed in 2.6.7; fixed in 2.5.11.

  • CVE-2016-8614Medium 6.3

    A flaw was found in Ansible before version 2.2.0.

    Affected: fixed in 2.2.0.0.

  • Ansible before version 2.2.0 fails to properly sanitize fact variables sent from the Ansible controller.

    Affected: fixed in 2.2.0.0.

  • An input validation vulnerability was found in Ansible's mysql_user module before 2.2.1.0, which may fail to correctly change a password…

    Affected: fixed in 2.2.1.0.

  • CVE-2017-7481Medium 5.3

    Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe.

    Affected: fixed in 2.3.1.0; from 2.3.2.0, fixed in 2.4.0.0; from 2.3.0.0, fixed in 2.3.1.0; fixed in 2.1.6.0; from 2.2.0.0, fixed in 2.2.3.0.

  • A flaw was found in ansible.

    Affected: fixed in 2.4.6.0; from 2.5.0a1, fixed in 2.5.6; from 2.6.0a1, fixed in 2.6.1; from 2.5, fixed in 2.5.6; from 2.4, fixed in 2.4.6.0; from 2.6, fixed in 2.6.1.

  • CVE-2018-10855Medium 5.9

    Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks.

    Affected: from 2.5.0a1, fixed in 2.5.5; from 2.4.0.0, fixed in 2.4.5.0; from 2.5, fixed in 2.5.5; from 2.4, fixed in 2.4.5.0.

  • In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under…

    Affected: fixed in 2.4.6.0; from 2.5, fixed in 2.5.6; from 2.6, fixed in 2.6.1; fixed in 2.4.6.0; from 2.5, fixed in 2.5.6; from 2.6, fixed in 2.6.1.

  • Ansible before version 2.3 has an input validation vulnerability in the handling of data sent from client systems.

    Affected: fixed in 2.2.3.0; fixed in 2.3.0.0.

  • Ansible before 1.2.1 makes it easier for remote attackers to conduct man-in-the-middle attacks by leveraging failure to cache SSH host keys.

    Affected: fixed in 1.2.1.

  • CVE-2016-9587Medium 6.6

    Ansible before versions 2.1.4, 2.2.1 is vulnerable to an improper input validation in Ansible's handling of data sent from client systems.

    Affected: fixed in 2.1.4.0; from 2.2.0.0, fixed in 2.2.1.0; fixed in 2.1.4.0; from 2.2.0.0, fixed in 2.2.1.0.

  • A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkins_plugin module.

    Affected: from 2.4.0.0, fixed in 2.4.1.0; from 2.3.0.0, fixed in 2.3.3.0; from 2.3.0.0, fixed in 2.3.3.0; from 2.4.0.0, fixed in 2.4.1.0.

  • The user module in ansible before 1.6.6 allows remote authenticated users to execute arbitrary commands.

    Affected: fixed in 1.6.6; fixed in 1.6.6.

  • The chroot, jail, and zone connection plugins in ansible before 1.9.2 allow local users to escape a restricted environment via a symlink…

    Affected: fixed in 1.9.2; fixed in 1.9.2.

  • The create_script function in the lxc_container module in Ansible before 1.9.6-1 and 2.x before 2.0.2.0 allows local users to write to…

    Affected: fixed in 2.0.2.0; from 2.0.0.0, fixed in 2.0.2.0; fixed in 1.9.6.1.

  • Ansible before 1.9.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName…

    Affected: fixed in 1.9.2.

  • lib/ansible/playbook/init.py in Ansible 1.2.x before 1.2.3, when playbook does not run due to an error, allows local users to overwrite…

    Affected: from 1.2, fixed in 1.2.3; from 1.2.0, fixed in 1.2.3.

  • runner/connection_plugins/ssh.py in Ansible before 1.2.3, when using ControlPersist, allows local users to redirect a ssh session via a…

    Affected: fixed in 1.2.3.