Lucene search

[email protected]CVE-2024-0690

HistoryFeb 06, 2024 - 12:15 p.m.

CVE-2024-0690

2024-02-0612:15:55

CWE-116

CWE-117

[email protected]

web.nvd.nist.gov

166

cve-2024-0690

information disclosure

ansible

ansible_no_log

security flaw

vulnerability

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

16.0%

JSON

An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG configuration in some scenarios. Information is still included in the output in certain tasks, such as loop items. Depending on the task, this issue may include sensitive information, such as decrypted secret values.

Affected configurations

NVD

Node

redhatansibleRange<2.14.4

redhatansibleRange2.15.0–2.15.9

redhatansibleRange2.16.0–2.16.3

redhatenterprise_linuxMatch8.0

redhatenterprise_linuxMatch9.0

Node

redhatansible_automation_platformMatch2.4

redhatansible_developerMatch1.1

redhatansible_insideMatch1.2

AND

redhatenterprise_linuxMatch8.0

redhatenterprise_linuxMatch9.0

Node

fedoraprojectfedoraMatch38

fedoraprojectfedoraMatch39

CPENameOperatorVersion
redhat:ansibleredhat ansiblelt2.14.4
redhat:ansibleredhat ansiblelt2.15.9
redhat:ansibleredhat ansiblelt2.16.3
redhat:enterprise_linuxredhat enterprise linuxeq8.0
redhat:enterprise_linuxredhat enterprise linuxeq9.0

CPE	Name	Operator	Version
redhat:ansible	redhat ansible	lt	2.14.4
redhat:ansible	redhat ansible	lt	2.15.9
redhat:ansible	redhat ansible	lt	2.16.3
redhat:enterprise_linux	redhat enterprise linux	eq	8.0
redhat:enterprise_linux	redhat enterprise linux	eq	9.0

CNA Affected

[
  {
    "versions": [
      {
        "status": "affected",
        "version": "2.14.0",
        "lessThan": "2.14.4",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "2.15.0",
        "lessThan": "2.15.9",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "2.16.0",
        "lessThan": "2.16.3",
        "versionType": "semver"
      }
    ],
    "packageName": "ansible",
    "collectionURL": "https://www.ansible.com/",
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Ansible Automation Platform 2.4 for RHEL 8",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "ansible-core",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "1:2.15.9-1.el8ap",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:ansible_automation_platform_developer:2.4::el8",
      "cpe:/a:redhat:ansible_automation_platform_inside:2.4::el8",
      "cpe:/a:redhat:ansible_automation_platform:2.4::el9",
      "cpe:/a:redhat:ansible_automation_platform_inside:2.4::el9",
      "cpe:/a:redhat:ansible_automation_platform_developer:2.4::el9",
      "cpe:/a:redhat:ansible_automation_platform:2.4::el8"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Ansible Automation Platform 2.4 for RHEL 9",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "ansible-core",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "1:2.15.9-1.el9ap",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:ansible_automation_platform_developer:2.4::el8",
      "cpe:/a:redhat:ansible_automation_platform_inside:2.4::el8",
      "cpe:/a:redhat:ansible_automation_platform:2.4::el9",
      "cpe:/a:redhat:ansible_automation_platform_inside:2.4::el9",
      "cpe:/a:redhat:ansible_automation_platform_developer:2.4::el9",
      "cpe:/a:redhat:ansible_automation_platform:2.4::el8"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 8",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "ansible-core",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "0:2.16.3-2.el8",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:enterprise_linux:8::appstream"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 9",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "ansible-core",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "1:2.14.14-1.el9",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:enterprise_linux:9::appstream"
    ]
  }
]