# Ansible-vault.0.3.0 Vulnerability

**URL:** <https://forum.ansible.com/t/ansible-vault-0-3-0-vulnerability/3256>\
**Category:** Get Help\
**Tags:** windows, collections\
**Created:** [January 11, 2024, 3:51am UTC](https://forum.ansible.com/t/ansible-vault-0-3-0-vulnerability/3256 "2024-01-11T03:51:18Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![chinhuiyin98](https://avatars.discourse-cdn.com/v4/letter/c/cc9497/32.png) [@chinhuiyin98](https://forum.ansible.com/u/chinhuiyin98)\
**Post date:** [January 11, 2024, 3:51am UTC](https://forum.ansible.com/t/ansible-vault-0-3-0-vulnerability/3256/1 "2024-01-11T03:51:18Z")

</div>

Hi All,

Recently, we did a project and has installed ansible package inside our project. During VAPT scanning, it flagged out has vulnerability due to the ansible-vault.nuspec.

Please check the screenshot for reference

 ![ansiblevault vulnerability](https://us1.discourse-cdn.com/ansible/original/2X/8/82ea863a22f24bcac0c6a7de20be6feb3198646e.jpeg)

C:\Users\10126226\Desktop\JTC\VAPT\_Python\_Scan\ansible-4.10.0.tar.gz\ansible-4.10.0.tar\ansible-4.10.0\ansible\_collections\community\windows\tests\integration\targets\win\_psmodule\_info\files  
ansiblevault.0.3.0.nupkg

Thanks.

---

<div class="post-metadata">

**Author:** ![felixfontein](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/felixfontein/32/7530_2.png) [@felixfontein](https://forum.ansible.com/u/felixfontein)\
**Post date:** [January 11, 2024, 5:54am UTC](https://forum.ansible.com/t/ansible-vault-0-3-0-vulnerability/3256/2 "2024-01-11T05:54:39Z")

</div>

1. This problem doesn’t have anything to do with Ansible Vault directly, but with a binary file `AnsibleVault.nuget` that’s part of the integration tests of the community.windows collection ([community.windows/tests/integration/targets/win\_psmodule\_info/files/ansiblevault.0.3.0.nupkg at main · ansible-collections/community.windows · GitHub](https://github.com/ansible-collections/community.windows/blob/main/tests/integration/targets/win_psmodule_info/files/ansiblevault.0.3.0.nupkg)). This is nothing that regular users of Ansible ever encounter.
2. The file is not part of the **Ansible (community package) installation**, only of the source distribution. Once you install Ansible, that file won’t end up on your disk.

So in any case, this is **not** a vulnerability affecting anyone except potentially the integration tests of one of the collections included in Ansible (and even there, it’s only used to test a module, and not used itself to run something, so the vulnerability in that program isn’t a problem for the tests as far as I can see).

I’ll create an issue in the collection so the collection maintainers can update or replace the program.

---

<div class="post-metadata">

**Author:** ![felixfontein](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/felixfontein/32/7530_2.png) [@felixfontein](https://forum.ansible.com/u/felixfontein)\
**Post date:** [January 11, 2024, 5:58am UTC](https://forum.ansible.com/t/ansible-vault-0-3-0-vulnerability/3256/3 "2024-01-11T05:58:47Z")

</div>

Issue: [Security scanners flag tests/integration/targets/win\_psmodule\_info/files/ansiblevault.0.3.0.nupkg · Issue #549 · ansible-collections/community.windows · GitHub](https://github.com/ansible-collections/community.windows/issues/549)