GHSA-h24r-m9qc-pvpg
Ansible-core information disclosure flaw
At a glance
- Published
- Updated
- CVE
- CVE-2024-0690
- Aliases
- PYSEC-2024-36
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Description
An information disclosure flaw was found in ansible-core due to a failure to respect the `ANSIBLE_NO_LOG` configuration in some scenarios. It was discovered that information is still included in the output in certain tasks, such as loop items. Depending on the task, this issue may include sensitive information, such as decrypted secret values.
Affected packages
| Package | Versions |
|---|---|
| PyPI · ansible-core | introduced 0, fixed 2.14.14 |
| PyPI · ansible-core | introduced 2.16.0, fixed 2.16.3 |
| PyPI · ansible-core | introduced 2.15.0, fixed 2.15.9 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-0690 ADVISORY
- https://github.com/ansible/ansible/pull/82565 WEB
- https://github.com/ansible/ansible/commit/6935c8e303440addd3871ecf8e04bde61080b032 WEB
- https://github.com/ansible/ansible/commit/78db3a3de6b40fb52d216685ae7cb903c609c3e1 WEB
- https://github.com/ansible/ansible/commit/b9a03bbf5a63459468baf8895ff74a62e9be4532 WEB
- https://github.com/ansible/ansible/commit/beb04bc2642c208447c5a936f94310528a1946b1 WEB
- https://access.redhat.com/errata/RHSA-2024:0733 WEB
- https://access.redhat.com/errata/RHSA-2024:2246 WEB
- https://access.redhat.com/errata/RHSA-2024:3043 WEB
- https://access.redhat.com/security/cve/CVE-2024-0690 WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2259013 WEB
- https://github.com/ansible/ansible PACKAGE
- https://github.com/pypa/advisory-database/tree/main/vulns/ansible-core/PYSEC-2024-36.yaml WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IZQGCRDSZL7ONCULMB6ZUHOE4L44KIBP WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VDYSWOCPZMNRU5LWKIEBW4WGWLMTU7WQ WEB
- https://security.netapp.com/advisory/ntap-20250117-0001 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |