CVEvulnerability

CVE-2024-0690

5.5 MEDIUM Published 2024-02-06 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2024-02-06
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.0 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
CVSS 3.1 ([email protected])
5.5 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-116, CWE-117

Description

An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG configuration in some scenarios. Information is still included in the output in certain tasks, such as loop items. Depending on the task, this issue may include sensitive information, such as decrypted secret values.

Affected configurations

• redhat ansible (< 2.14.4) • redhat ansible (>= 2.15.0 < 2.15.9) • redhat ansible (>= 2.16.0 < 2.16.3) • redhat enterprise linux 8.0 • redhat enterprise linux 9.0 • redhat ansible automation platform 2.4 • redhat ansible developer 1.1 • redhat ansible inside 1.2 • fedoraproject fedora 38 • fedoraproject fedora 39

Related

Weakness · CWE (2)

  • CWE-116 Improper Encoding or Escaping of Output weakness
  • CWE-117 Improper Output Neutralization for Logs weakness

References