Ansible-core: possible information leak in tasks that ignore ansible_no_log configuration (ansible)
En bref
- Source
- NVD
- EPSS
- EPSS 0.30 % · centile 23 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- redhat
- Statut NVD
- Modified
Description
An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG configuration in some scenarios. Information is still included in the output in certain tasks, such as loop items. Depending on the task, this issue may include sensitive information, such as decrypted secret values.
Faiblesses (CWE)
- CWE-117 — Neutralisation incorrecte des sorties de journalisation
- CWE-116 — Encodage ou échappement incorrect de la sortie
Références
- https://access.redhat.com/errata/RHSA-2024:0733
- https://access.redhat.com/errata/RHSA-2024:2246
- https://access.redhat.com/errata/RHSA-2024:3043
- https://access.redhat.com/security/cve/CVE-2024-0690
- https://bugzilla.redhat.com/show_bug.cgi?id=2259013
- https://github.com/ansible/ansible/pull/82565
- https://security.netapp.com/advisory/ntap-20250117-0001/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IZQGCRDSZL7ONCULMB6ZUHOE4L44KIBP/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VDYSWOCPZMNRU5LWKIEBW4WGWLMTU7WQ/
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.0 | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N | redhat |
| CVSS 3.1 | MEDIUM 5.0 | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N | NVD · secalert@redhat.com (Secondary) |
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-h24r-m9qc-pvpg — Ansible-core information disclosure flaw
- PYSEC-2024-36 — An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG configuration in some scenarios. It was discovered that
Références européennes
- ENISA EUVD · EUVD-2024-0003
- GCVE · GCVE-0-2024-0690
Avis du CERT-FR
- CERTFR-2025-AVI-0214 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0459 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*< 2.14.4cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*≥ 2.15.0 < 2.15.9cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*≥ 2.16.0 < 2.16.3cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:ansible_automation_platform:2.4:*:*:*:*:*:*:*cpe:2.3:a:redhat:ansible_developer:1.1:*:*:*:*:*:*:*cpe:2.3:a:redhat:ansible_inside:1.2:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| ansible | affected 2.14.0 < 2.14.4 ; affected 2.15.0 < 2.15.9 ; affected 2.16.0 < 2.16.3 |
| Red Hat · Red Hat Ansible Automation Platform 2.4 for RHEL 8 | unaffected 1:2.15.9-1.el8ap < * |
| Red Hat · Red Hat Ansible Automation Platform 2.4 for RHEL 9 | unaffected 1:2.15.9-1.el9ap < * |
| Red Hat · Red Hat Enterprise Linux 8 | unaffected 0:2.16.3-2.el8 < * |
| Red Hat · Red Hat Enterprise Linux 9 | unaffected 1:2.14.14-1.el9 < * |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |