Skip to content
CVE PROGRAM SOURCE RECORD5.0 Medium

CVE-2024-0690

Ansible-core: possible information leak in tasks that ignore ansible_no_log configuration

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG configuration in some scenarios. Information is still included in the output in certain tasks, such as loop items. Depending on the task, this issue may include sensitive information, such as decrypted secret values.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

ansible

Default version status: unaffected

  • 2.14.0 to < 2.14.4affected
  • 2.15.0 to < 2.15.9affected
  • 2.16.0 to < 2.16.3affected

Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 8

Default version status: affected

  • 1:2.15.9-1.el8ap to < *unaffected

Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 9

Default version status: affected

  • 1:2.15.9-1.el9ap to < *unaffected

Red Hat Red Hat Enterprise Linux 8

Default version status: affected

  • 0:2.16.3-2.el8 to < *unaffected

Red Hat Red Hat Enterprise Linux 9

Default version status: affected

  • 1:2.14.14-1.el9 to < *unaffected

References