Information Disclosure

2019-01-1509:20:02

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.003 Low

EPSS

Percentile

71.9%

JSON

ansible is vulnerable to information disclosure. The application doesn’t properly enforce the no_log flag, meaning that sensitive information that has been passed to the task will be logged by the system. This allows a malicious user with access to the logs can gain access to this sensitive information.

CPENameOperatorVersion
ansible-role-redhat-subscriptioneq1.0.1__1.el7
ansible-role-redhat-subscriptioneq1.0.1__1.el7ost
ansibleeq2.3.1.0__3.el7
ansibleeq2.4.3.0__1.el7
ansibleeq2.4.5.0__1.el7ae
ansibleeq2.4.2.0__0.el7
ansibleeq2.4.1.0__1.el7
ansibleeq2.5.1__1.el7ae
ansibleeq2.4.4.0__1.el7.ans
ansibleeq2.2.0__0.50.prerelease.el7

Name	Operator	Version
ansible-role-redhat-subscription	eq	1.0.1__1.el7
ansible-role-redhat-subscription	eq	1.0.1__1.el7ost
ansible	eq	2.3.1.0__3.el7
ansible	eq	2.4.3.0__1.el7
ansible	eq	2.4.5.0__1.el7ae
ansible	eq	2.4.2.0__0.el7
ansible	eq	2.4.1.0__1.el7
ansible	eq	2.5.1__1.el7ae
ansible	eq	2.4.4.0__1.el7.ans
ansible	eq	2.2.0__0.50.prerelease.el7