A flaw was found in Ansible, where a user's controller is vulnerable to template injection. This issue can occur through facts used in the template if the user is trying to put templates in multi-line YAML strings and the facts being handled do not routinely include special template characters. This flaw allows attackers to perform command injection, which discloses sensitive information. The highest threat from this vulnerability is to confidentiality and integrity.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5315-1 advisory.

  - An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory     when running become_user from become directive. The provided fix is insufficient to prevent the race     condition on systems using ACLs and FUSE filesystems. Ansible Engine 2.7.18, 2.8.12, and 2.9.9 as well as     previous versions are affected and Ansible Tower 3.4.5, 3.5.6 and 3.6.4 as well as previous versions are     affected. (CVE-2020-10744)

  - A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when     running a playbook with an unprivileged become user. When Ansible needs to run a module with become user,     the temporary directory is created in /var/tmp. This directory is created with umask 77 && mkdir -p     <dir>; this operation does not fail if the directory already exists and is owned by another user. An     attacker could take advantage to gain control of the become user as the target directory can be retrieved     by iterating '/proc/<pid>/cmdline'. (CVE-2020-1733)

  - A flaw was found in Ansible, where a user's controller is vulnerable to template injection. This issue can     occur through facts used in the template if the user is trying to put templates in multi-line YAML strings     and the facts being handled do not routinely include special template characters. This flaw allows     attackers to perform command injection, which discloses sensitive information. The highest threat from     this vulnerability is to confidentiality and integrity. (CVE-2021-3583)

  - A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the     Ansible user credentials is disclosed by default in the traceback error message. The highest threat from     this vulnerability is to confidentiality. (CVE-2021-3620)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of ansible installed on the remote host is prior to 2.9.23-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2ANSIBLE2-2023-001 advisory.

  - A flaw was found in Ansible, where a user's controller is vulnerable to template injection. This issue can     occur through facts used in the template if the user is trying to put templates in multi-line YAML strings     and the facts being handled do not routinely include special template characters. This flaw allows     attackers to perform command injection, which discloses sensitive information. The highest threat from     this vulnerability is to confidentiality and integrity. (CVE-2021-3583)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3178-1 advisory.

  - A flaw was found in ansible module where credentials are disclosed in the console log by default and not     protected by the security feature when using the bitbucket_pipeline_variable module. This flaw allows an     attacker to steal bitbucket_pipeline credentials. The highest threat from this vulnerability is to     confidentiality. (CVE-2021-20178, CVE-2021-20180)

  - A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default     and not protected by no_log feature when using those modules. An attacker can take advantage of this     information to steal those credentials. The highest threat from this vulnerability is to data     confidentiality. Versions before ansible 2.9.18 are affected. (CVE-2021-20191)

  - A flaw was found in the Ansible Engine 2.9.18, where sensitive info is not masked by default and is not     protected by the no_log feature when using the sub-option feature of the basic.py module. This flaw allows     an attacker to obtain sensitive information. The highest threat from this vulnerability is to     confidentiality. (CVE-2021-20228)

  - A flaw was found in several ansible modules, where parameters containing credentials, such as secrets,     were being logged in plain-text on managed nodes, as well as being made visible on the controller node     when run in verbose mode. These parameters were not protected by the no_log feature. An attacker can take     advantage of this information to steal those credentials, provided when they have access to the log files     containing them. The highest threat from this vulnerability is to data confidentiality. This flaw affects     Red Hat Ansible Automation Platform in versions before 1.2.2 and Ansible Tower in versions before 3.8.2.
    (CVE-2021-3447)

  - A flaw was found in Ansible, where a user's controller is vulnerable to template injection. This issue can     occur through facts used in the template if the user is trying to put templates in multi-line YAML strings     and the facts being handled do not routinely include special template characters. This flaw allows     attackers to perform command injection, which discloses sensitive information. The highest threat from     this vulnerability is to confidentiality and integrity. (CVE-2021-3583)

  - A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the     Ansible user credentials is disclosed by default in the traceback error message. The highest threat from     this vulnerability is to confidentiality. (CVE-2021-3620)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:2664 advisory.

  - ansible: Template Injection through yaml multi-line strings with ansible facts used in template.
    (CVE-2021-3583)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:2663 advisory.

  - ansible: Template Injection through yaml multi-line strings with ansible facts used in template.
    (CVE-2021-3583)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Ansible developers report :

Templating engine fix for not preserving usnafe status when trying to preserve newlines.

ID	Name	Product	Family	Severity
183136	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 ESM : Ansible vulnerabilities (USN-5315-1)	Nessus	Ubuntu Local Security Checks	high
182012	Amazon Linux 2 : ansible (ALASANSIBLE2-2023-001)	Nessus	Amazon Linux Local Security Checks	high
164906	SUSE SLES15 : Important security update for SUSE Manager Client Tools (SUSE-SU-2022:3178-1)	Nessus	SuSE Local Security Checks	high
151446	RHEL 7 / 8 : Ansible security update (2.9.23) (Important) (RHSA-2021:2664)	Nessus	Red Hat Local Security Checks	high
151445	RHEL 7 / 8 : Ansible security update (2.9.23) (Important) (RHSA-2021:2663)	Nessus	Red Hat Local Security Checks	high
151009	FreeBSD : Ansible -- Templating engine bug (4c9159ea-d4c9-11eb-aeee-8c164582fbac)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2021-3583

high

Tenable Plugins

high

high

high

high

high

high