An input validation vulnerability was found in Ansible's mysql_user module before 2.2.1.0, which may fail to correctly change a password in

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• redhat ansible enginebefore 2.2.1.0
• redhat virtualization4.1

Versions reported by the vendor

Affected version ranges reported by the assigning authority (redhat). Independent of NVD's CPE analysis and usually ahead of it.

• Red Hat Ansible

  • 2.2.1.0affected

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2021-20228A flaw was found in the Ansible Engine 2.9.18, where sensitive info is not masked by default and is not protected by the no_log feature when
  31Monitor
• CVE-2020-1737A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-Zip function from the win_unzip mo
  31Monitor
• CVE-2019-14846In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG
  31Monitor
• CVE-2018-16837Ansible "User" module leaks any data which is passed on as a parameter to ssh-keygen.
  31Monitor
• CVE-2018-10875A flaw was found in ansible.
  31Monitor
• CVE-2018-10874In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attac
  31Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.