AnsibleByExample

Ansible-core 2.21.4 Released - Security Hardening for URL Authentication Masking

Beginner
2024-01-013By Luca Berton

Lesson 1 of 16 in Security & Compliance

Ansible Security and Compliance Automation — full curriculum
  1. 1. The Compliance-as-Code Model (and Where Ansible Fits)
  2. 2. Ansible's Security Automation Building Blocks
  3. 3. CIS Benchmarks and DISA STIGs Explained
  4. 4. Scanning Hosts for Compliance Drift with OpenSCAP and Ansible
  5. 5. Ansible Lockdown: Using STIG and CIS Roles in Practice
  6. 6. Custom Compliance Checks with assert and Facts
  7. 7. Remediating Findings Safely
  8. 8. CVE-Driven Patch Management
  9. 9. Firewall and SELinux Hardening at Scale
  10. 10. User, Access and Sudo Policy Enforcement
  11. 11. Secrets and Credential Hygiene at Scale
  12. 12. Audit Logging, Reporting and Evidence for Auditors
  13. 13. Event-Driven Remediation with Event-Driven Ansible
  14. 14. Continuous Compliance in CI/CD Pipelines
  15. 15. Change Control and Safe Rollback for Security Playbooks
  16. 16. Capstone: Automated Compliance Pipeline — Scan, Remediate, Report
View path overview →

Introduction

Ansible-core 2.21.4 was published on 2026-09-08, following 2.21.3. This is a bugfix release focused almost entirely on hardening how sensitive authentication data embedded in URLs is masked in module output, logs, and error messages. It also includes a small hardening fix for the tempfile module utility. No new features are introduced beyond a supporting minor change to mask_url.

Whats New

Minor Changes

  • mask_url function in module_utils has been extended to allow masking of authentication data embedded in URLs, providing the foundation used by several of the bugfixes below.

Bugfixes

The bulk of this release addresses a class of issues where authentication credentials embedded in URLs (e.g. user:password@host or :password@host) could leak into module output, return values, or error messages instead of being masked:

  • apt_key module now masks authentication information in all displays and returns of URI information.
  • get_url module now masks authentication information in all displays and returns of URI information.
  • module_utils - mask_url now correctly masks the password in URLs that contain a password but no username, such as redis://:password@host, instead of returning them unmasked.
  • module_utils.urls now masks in-line URL authentication information across all error messages.
  • rpm_key module now masks authentication information in all displays and returns of URI information.
  • uri module now masks authentication information in all displays and returns of URI information.
  • url lookup plugin now masks authentication information in all displays and returns of URI information.
  • tempfile module utility now rejects prefix and suffix values that contain path components, preventing a path traversal vector.

Affected Components

ComponentTypeChange
apt_keyModuleMasks auth info in URI output
get_urlModuleMasks auth info in URI output
rpm_keyModuleMasks auth info in URI output
uriModuleMasks auth info in URI output
urlLookup pluginMasks auth info in URI output
module_utils.urlsModule utilMasks auth info in error messages
mask_urlModule util functionFixed masking for password-only URLs
tempfileModule utilRejects path components in prefix/suffix

Full details are available in the CHANGELOG-v2.21.rst.

Release Artifacts

  • Built Distribution: ansible_core-2.21.4-py3-none-any.whl - 2457154 bytes - SHA256: ebe74d9c8fadcb41ad2151e031bf1e785e3098aaa015019b4e19a0a96f0dcc4f
  • Source Distribution: ansible_core-2.21.4.tar.gz - 3394492 bytes - SHA256: 81a9329f4f12cfa5008dcab5d1bf23ae69b7effc08c0f00048ab2461147ae95a

How to Test

Install or upgrade ansible-core 2.21.4 in a virtual environment and verify the version and checksums before rolling it out.

# Create an isolated test environment
python3 -m venv ansible-2214-test
source ansible-2214-test/bin/activate

# Install ansible-core 2.21.4 explicitly
pip install ansible-core==2.21.4

# Confirm the installed version
ansible --version

# Download and verify the sdist checksum manually if needed
curl -LO https://files.pythonhosted.org/packages/df/72/2152230f254bd9c6b892f95d6d291a96fd09b632ce01c6b406eda8c5cd75/ansible_core-2.21.4.tar.gz
sha256sum ansible_core-2.21.4.tar.gz
# Expected: 81a9329f4f12cfa5008dcab5d1bf23ae69b7effc08c0f00048ab2461147ae95a

# Sanity-check the modules affected by this release
ansible-doc apt_key
ansible-doc get_url
ansible-doc rpm_key
ansible-doc uri
ansible-doc -t lookup url

After upgrading, review any playbooks or roles that use get_url, uri, apt_key, rpm_key, or the url lookup with embedded credentials in URLs, and confirm that logs and --check/-vvv output no longer expose plaintext credentials.

All Tutorials