VYPR
← All advisories
Moderate severityNVD Advisory· Published Mar 3, 2022· Updated Feb 13, 2025

CVE-2021-3620

CVE-2021-3620

Description

A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Ansible Engine's ansible-connection module discloses user credentials in traceback error messages, leading to information disclosure.

Vulnerability

The ansible-connection module in Ansible Engine improperly includes sensitive information such as Ansible user credentials in default traceback error messages. This flaw affects Ansible Engine versions before 2.9.23, 2.10.x before 2.10.12, and 3.x before 3.4.0 [1][2][3]. The bug is triggered when connection errors occur and the module outputs debugging or error information.

Exploitation

An attacker can exploit this vulnerability by causing a connection error in the ansible-connection module, which generates a traceback that reveals credentials. This can be achieved by an attacker with the ability to trigger an Ansible connection attempt (e.g., by controlling a target host or by inducing a misconfiguration) [2][3]. No special privileges are required beyond the ability to trigger a connection failure.

Impact

Successful exploitation results in disclosure of sensitive Ansible user credentials, such as SSH keys or passwords, which can be used to compromise managed hosts and escalate privileges. The highest threat is to confidentiality [3][4].

Mitigation

Red Hat released an errata (RHSA-2021:4703) with fixes in Ansible Engine 2.9.23, 2.10.12, and 3.4.0 [1][2]. Users should update to these or later versions. As a workaround, ensure that error tracebacks are not exposed to untrusted users and that logs containing tracebacks are properly secured.

References
  1. https://access.redhat.com/errata/RHSA-2021:4703
  2. cve-details
  3. NVD - CVE-2021-3620
  4. CVE-2021-3620 - GitHub Advisory Database

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
ansiblePyPI
< 2.9.272.9.27

Affected products

73

Patches

1
fe28767970c8

Fixed exposed credentials in exception

https://github.com/ansible/ansibledalrrardJun 7, 2021via ghsa
commit
1 file changed · +18 −1
  • lib/ansible/module_utils/connection.py+18 −1 modified
    @@ -38,10 +38,13 @@
 import uuid
 
 from functools import partial
+from ansible import constants as C
 from ansible.module_utils._text import to_bytes, to_text
 from ansible.module_utils.common.json import AnsibleJSONEncoder
+from ansible.module_utils.common.parameters import remove_values
 from ansible.module_utils.six import iteritems
 from ansible.module_utils.six.moves import cPickle
+from ansible.utils.helpers import deduplicate_list
 
 
 def write_to_file_descriptor(fd, obj):
@@ -163,12 +166,26 @@ def _exec_jsonrpc(self, name, *args, **kwargs):
         try:
             response = json.loads(out)
         except ValueError:
-            params = [repr(arg) for arg in args] + ['{0}={1!r}'.format(k, v) for k, v in iteritems(kwargs)]
+            sensitive_keys = list(
+                    C.MAGIC_VARIABLE_MAPPING["password"]
+                    + C.MAGIC_VARIABLE_MAPPING["private_key_file"]
+                    + C.MAGIC_VARIABLE_MAPPING["become_pass"]
+            )
+            sensitive_values = [
+                v2 
+                for k, v in iteritems(kwargs) 
+                for k2, v2 in iteritems(v) 
+                if k2 in sensitive_keys
+            ]
+            params = [repr(remove_values(arg, sensitive_values)) for arg in args] + [
+                "{0}={1!r}".format(k, remove_values(v, sensitive_values)) 
+                for k, v in iteritems(kwargs)]
             params = ', '.join(params)
             raise ConnectionError(
                 "Unable to decode JSON from response to {0}({1}). Received '{2}'.".format(name, params, out)
             )
 
+
         if response['id'] != reqid:
             raise ConnectionError('invalid json-rpc id received')
         if "result_type" in response:

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

13

News mentions

0

No linked articles in our index yet.