medium5.0
CVE-2024-0690
Ansible-core information disclosure flaw
Impact
An information disclosure flaw was found in ansible-core due to a failure to respect the `ANSIBLE_NO_LOG` configuration in some scenarios. It was discovered that information is still included in the output in certain tasks, such as loop items. Depending on the task, this issue may include sensitive information, such as decrypted secret values.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | ansible-core | < 2.14.14 | 2.14.14 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Redhat | Ansible | before 2.14.4 from 2.15.0 before 2.15.9 from 2.16.0 before 2.16.3 |
| Redhat | Enterprise Linux | Versions 8.0, 9.0 |
| Redhat | Ansible Automation Platform | Version 2.4 |
| Redhat | Ansible Developer | Version 1.1 |
| Redhat | Ansible Inside | Version 1.2 |
| Fedoraproject | Fedora | Versions 38, 39 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://access.redhat.com/errata/RHSA-2024:0733
- https://access.redhat.com/errata/RHSA-2024:2246
- https://access.redhat.com/errata/RHSA-2024:3043
- https://access.redhat.com/security/cve/CVE-2024-0690
- https://bugzilla.redhat.com/show_bug.cgi?id=2259013
- https://github.com/ansible/ansible/pull/82565
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IZQGCRDSZL7ONCULMB6ZUHOE4L44KIBP/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VDYSWOCPZMNRU5LWKIEBW4WGWLMTU7WQ/
- https://security.netapp.com/advisory/ntap-20250117-0001/
- https://github.com/advisories/GHSA-h24r-m9qc-pvpg
- https://nvd.nist.gov/vuln/detail/CVE-2024-0690
- https://github.com/ansible/ansible/commit/6935c8e303440addd3871ecf8e04bde61080b032
- https://github.com/ansible/ansible/commit/78db3a3de6b40fb52d216685ae7cb903c609c3e1
- https://github.com/ansible/ansible/commit/b9a03bbf5a63459468baf8895ff74a62e9be4532
- https://github.com/ansible/ansible/commit/beb04bc2642c208447c5a936f94310528a1946b1
- https://github.com/pypa/advisory-database/tree/main/vulns/ansible-core/PYSEC-2024-36.yaml
- https://security.netapp.com/advisory/ntap-20250117-0001
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IZQGCRDSZL7ONCULMB6ZUHOE4L44KIBP
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VDYSWOCPZMNRU5LWKIEBW4WGWLMTU7WQ