GHSA-j2h6-73x8-22c4
Exposure of Sensitive Information to an Unauthorized Actor in ansible
At a glance
- Published
- Updated
- CVE
- CVE-2020-1746
- Aliases
- PYSEC-2020-13
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
- CVSS_V4
- CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Description
A flaw was found in the Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when the ldap_attr and ldap_entry community modules are used. The issue discloses the LDAP bind password to stdout or a log file if a playbook task is written using the `bind_pw` in the parameters field. The highest threat from this vulnerability is data confidentiality.
Affected packages
| Package | Versions |
|---|---|
| PyPI · ansible | introduced 2.8.0a1, fixed 2.8.11 |
| PyPI · ansible | introduced 2.9.0a1, fixed 2.9.7 |
| PyPI · ansible | introduced 2.7.0a1, fixed 2.7.17 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-1746 ADVISORY
- https://github.com/ansible/ansible/pull/67866 WEB
- https://github.com/ansible/ansible/commit/d41e38435b1a9e300d8011ac28f16a5add2db119 WEB
- https://github.com/ansible/ansible/commit/e6199d768c1c18a4e750ec78d4ded088629baa3f WEB
- https://github.com/ansible/ansible/commit/edd1e1723cc937ec9251adf38c1199a00b0bf6d4 WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1746 WEB
- https://github.com/advisories/GHSA-j2h6-73x8-22c4 ADVISORY
- https://github.com/ansible/ansible PACKAGE
- https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2020-13.yaml WEB
- https://www.debian.org/security/2021/dsa-4950 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |