Code injection

2019-10-0819:15:00

PRIOn knowledge base

www.prio-n.com

7.2 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.2%

JSON

In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG level which lead to a disclosure of credentials if a plugin used a library that logged credentials at the DEBUG level. This flaw does not affect Ansible modules, as those are executed in a separate process.

CPENameOperatorVersion
debian_linuxeq8.0
debian_linuxeq9.0
debian_linuxeq10.0
backports_sleeq15.0 sp1
leapeq15.1
ansible_enginege2.7.0
ansible_enginelt2.7.14
ansible_enginege2.8.0
ansible_enginelt2.8.6
ansible_enginelt2.6.20

Name	Operator	Version
debian_linux	eq	8.0
debian_linux	eq	9.0
debian_linux	eq	10.0
backports_sle	eq	15.0 sp1
leap	eq	15.1
ansible_engine	ge	2.7.0
ansible_engine	lt	2.7.14
ansible_engine	ge	2.8.0
ansible_engine	lt	2.8.6
ansible_engine	lt	2.6.20