Ansible Engine vulnerabilitiesRanked by how likely they are to be used.
Ansible Engine is made by Red Hat. We track 27 published vulnerabilities in it, across 210 versions. None of them is on the list of flaws known to be exploited today. If you run Ansible Engine, keep it on a version the vendor still supports.
We keep watching the known-exploited list.
Which Ansible Engine vulnerabilities are being exploited?
This is the list that matters most: flaws criminals are using now.
None of Ansible Engine's published vulnerabilities is on the list of flaws known to be exploited today. We keep watching that list.
Which Ansible Engine flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- 27%CVE-2018-7750Critical
transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly...
- 4.8%CVE-2017-7481Critical
Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe.
- 3.1%CVE-2018-10855Medium
Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks.
- 2.5%CVE-2018-16876Medium
ansible before versions 2.5.14, 2.6.11, 2.7.5 is vulnerable to a information disclosure flaw in vvv+ mode with no_log on that can lead to leakage of sensible data.
- 2.1%CVE-2021-20228High
A flaw was found in the Ansible Engine 2.9.18, where sensitive info is not masked by default and is not protected by the no_log feature when using the sub-option feature of the basic.py module.
- 1.4%CVE-2016-8647Medium
An input validation vulnerability was found in Ansible's mysql_user module before 2.2.1.0, which may fail to correctly change a password in certain circumstances.
- 0.9%CVE-2021-3583High
A flaw was found in Ansible, where a user's controller is vulnerable to template injection.
- 0.7%CVE-2019-14905Medium
A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible's nxos_file_copy module can be used to copy files to a flash or bootflash...
- 0.6%CVE-2018-10875High
A flaw was found in ansible. ansible.cfg is read from the current working directory which can be altered to make it point to a plugin or a module path under the control of an attacker, thus allowing the attacker to...
- 0.6%CVE-2020-14330Medium
An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content and json output.
Running Ansible Engine? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 new flaw affects software Acme tracks
transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly check whether authentication is completed before processing other requests, as demonstrated by channel-open. A customized SSH client can simply skip the authentication step.
- Matched to
- Ansible Engine on Acme's software list
- What to do
- Plan in the vendor’s update
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
We track 27 published vulnerabilities listed under the name Ansible Engine, across 210 versions.
None of Ansible Engine's vulnerabilities is on the list of flaws known to be exploited today.
Create a Precursor Intelligence account and track Ansible Engine. We match it against every published flaw, give each one a risk score from 0 to 100 and keep watching, so you hear about new ones as soon as we know, by email, in the app or by webhook.