Ansible-core: possible information leak in tasks that ignore ansible_no_log configuration (ansible)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.30 % · percentile 23 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- redhat
- NVD status
- Modified
Description
An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG configuration in some scenarios. Information is still included in the output in certain tasks, such as loop items. Depending on the task, this issue may include sensitive information, such as decrypted secret values.
Weaknesses (CWE)
- CWE-117 — Improper Output Neutralization for Logs
- CWE-116 — Improper Encoding or Escaping of Output
References
- https://access.redhat.com/errata/RHSA-2024:0733
- https://access.redhat.com/errata/RHSA-2024:2246
- https://access.redhat.com/errata/RHSA-2024:3043
- https://access.redhat.com/security/cve/CVE-2024-0690
- https://bugzilla.redhat.com/show_bug.cgi?id=2259013
- https://github.com/ansible/ansible/pull/82565
- https://security.netapp.com/advisory/ntap-20250117-0001/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IZQGCRDSZL7ONCULMB6ZUHOE4L44KIBP/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VDYSWOCPZMNRU5LWKIEBW4WGWLMTU7WQ/
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.0 | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N | redhat |
| CVSS 3.1 | MEDIUM 5.0 | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N | NVD · secalert@redhat.com (Secondary) |
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-h24r-m9qc-pvpg — Ansible-core information disclosure flaw
- PYSEC-2024-36 — An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG configuration in some scenarios. It was discovered that
European references
- ENISA EUVD · EUVD-2024-0003
- GCVE · GCVE-0-2024-0690
CERT-FR advisories
- CERTFR-2025-AVI-0214 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0459 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*< 2.14.4cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*≥ 2.15.0 < 2.15.9cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*≥ 2.16.0 < 2.16.3cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:ansible_automation_platform:2.4:*:*:*:*:*:*:*cpe:2.3:a:redhat:ansible_developer:1.1:*:*:*:*:*:*:*cpe:2.3:a:redhat:ansible_inside:1.2:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| ansible | affected 2.14.0 < 2.14.4 ; affected 2.15.0 < 2.15.9 ; affected 2.16.0 < 2.16.3 |
| Red Hat · Red Hat Ansible Automation Platform 2.4 for RHEL 8 | unaffected 1:2.15.9-1.el8ap < * |
| Red Hat · Red Hat Ansible Automation Platform 2.4 for RHEL 9 | unaffected 1:2.15.9-1.el9ap < * |
| Red Hat · Red Hat Enterprise Linux 8 | unaffected 0:2.16.3-2.el8 < * |
| Red Hat · Red Hat Enterprise Linux 9 | unaffected 1:2.14.14-1.el9 < * |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |