CVEvulnerability
CVE-2020-14330
5.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2020-09-11
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.0 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
- CVSS 3.1 ([email protected])
- 5.5 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 2.1 LOW — AV:L/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-532
Description
An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content and json output. This flaw allows an attacker to access the logs or outputs of performed tasks to read keys used in playbooks from other users within the uri module. The highest threat from this vulnerability is to data confidentiality.
Affected configurations
• redhat ansible engine (< 2.9.12)
• debian debian linux 10.0
Related
Weakness · CWE (1)
- CWE-532 Insertion of Sensitive Information into Log File weakness
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14330 Issue Tracking, Vendor Advisory
- https://github.com/ansible/ansible/issues/68400 Exploit, Issue Tracking, Third Party Advisory
- https://www.debian.org/security/2021/dsa-4950 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14330 Issue Tracking, Vendor Advisory
- https://github.com/ansible/ansible/issues/68400 Exploit, Issue Tracking, Third Party Advisory
- https://www.debian.org/security/2021/dsa-4950 Third Party Advisory