GHSA-h24r-m9qc-pvpg

Ansible-core information disclosure flaw

En bref

Publiée: 2024-02-06 12:30 UTC
Mise à jour: 2026-06-09 13:05 UTC
CVE: CVE-2024-0690
Alias: PYSEC-2024-36
CVSS_V3: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Description

An information disclosure flaw was found in ansible-core due to a failure to respect the `ANSIBLE_NO_LOG` configuration in some scenarios. It was discovered that information is still included in the output in certain tasks, such as loop items. Depending on the task, this issue may include sensitive information, such as decrypted secret values.

Paquets affectés

Paquet	Versions
PyPI · ansible-core	introduced 0, fixed 2.14.14
PyPI · ansible-core	introduced 2.16.0, fixed 2.16.3
PyPI · ansible-core	introduced 2.15.0, fixed 2.15.9

Références

https://nvd.nist.gov/vuln/detail/CVE-2024-0690 ADVISORY
https://github.com/ansible/ansible/pull/82565 WEB
https://github.com/ansible/ansible/commit/6935c8e303440addd3871ecf8e04bde61080b032 WEB
https://github.com/ansible/ansible/commit/78db3a3de6b40fb52d216685ae7cb903c609c3e1 WEB
https://github.com/ansible/ansible/commit/b9a03bbf5a63459468baf8895ff74a62e9be4532 WEB
https://github.com/ansible/ansible/commit/beb04bc2642c208447c5a936f94310528a1946b1 WEB
https://access.redhat.com/errata/RHSA-2024:0733 WEB
https://access.redhat.com/errata/RHSA-2024:2246 WEB
https://access.redhat.com/errata/RHSA-2024:3043 WEB
https://access.redhat.com/security/cve/CVE-2024-0690 WEB
https://bugzilla.redhat.com/show_bug.cgi?id=2259013 WEB
https://github.com/ansible/ansible PACKAGE
https://github.com/pypa/advisory-database/tree/main/vulns/ansible-core/PYSEC-2024-36.yaml WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IZQGCRDSZL7ONCULMB6ZUHOE4L44KIBP WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VDYSWOCPZMNRU5LWKIEBW4WGWLMTU7WQ WEB
https://security.netapp.com/advisory/ntap-20250117-0001 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database