Ansible-core: exposure of sensitive information in ansible vault files due to improper logging (ansible-core)
En bref
- Source
- NVD
- EPSS
- EPSS 0.27 % · centile 19 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- redhat
- Statut NVD
- Deferred
Description
A flaw was found in Ansible, where sensitive information stored in Ansible Vault files can be exposed in plaintext during the execution of a playbook. This occurs when using tasks such as include_vars to load vaulted variables without setting the no_log: true parameter, resulting in sensitive data being printed in the playbook output or logs. This can lead to the unintentional disclosure of secrets like passwords or API keys, compromising security and potentially allowing unauthorized access or actions.
Faiblesses (CWE)
- CWE-532 — Informations sensibles insérées dans un fichier de journal
Références
- https://access.redhat.com/errata/RHSA-2024:10762
- https://access.redhat.com/errata/RHSA-2024:8969
- https://access.redhat.com/errata/RHSA-2024:9894
- https://access.redhat.com/errata/RHSA-2025:1249
- https://access.redhat.com/security/cve/CVE-2024-8775
- https://bugzilla.redhat.com/show_bug.cgi?id=2312119
- https://github.com/advisories/GHSA-jpxc-vmjf-9fcj
- https://lists.debian.org/debian-lts-announce/2024/11/msg00021.html
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | redhat |
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | NVD · secalert@redhat.com (Secondary) |
Avis
- GHSA-jpxc-vmjf-9fcj — Ansible vulnerable to Insertion of Sensitive Information into Log File
- PYSEC-2026-1124 — Ansible vulnerable to Insertion of Sensitive Information into Log File
Références européennes
- ENISA EUVD · EUVD-2024-2826
- GCVE · GCVE-0-2024-8775
Avis du CERT-FR
- CERTFR-2026-AVI-0667 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0627 — Multiples vulnérabilités dans les produits Splunk · cert.ssi.gouv.fr
Produits affectés
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |