Code injection

2018-07-0301:29:00

PRIOn knowledge base

www.prio-n.com

5.7 Medium

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

71.9%

JSON

Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on the terminal of the user running Ansible.

CPENameOperatorVersion
ubuntu_linuxeq16.04
ubuntu_linuxeq18.04
ubuntu_linuxeq19.04
debian_linuxeq9.0
ansible_engineeq2.0
ansible_enginegt2.5
ansible_enginele2.5.5
ansible_enginege2.4
ansible_enginelt2.4.5
cloudformseq4.6

Name	Operator	Version
ubuntu_linux	eq	16.04
ubuntu_linux	eq	18.04
ubuntu_linux	eq	19.04
debian_linux	eq	9.0
ansible_engine	eq	2.0
ansible_engine	gt	2.5
ansible_engine	le	2.5.5
ansible_engine	ge	2.4
ansible_engine	lt	2.4.5
cloudforms	eq	4.6