CVE-2020-1746
Summary
| CVE | CVE-2020-1746 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2020-05-12 18:15:00 UTC |
|---|
| Updated | 2023-11-07 03:19:00 UTC |
|---|
| Description | A flaw was found in the Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when the ldap_attr and ldap_entry community modules are used. The issue discloses the LDAP bind password to stdout or a log file if a playbook task is written using the bind_pw in the parameters field. The highest threat from this vulnerability is data confidentiality. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| CVE-2020-1746 - Remove the params module option from ldap_attr and ldap_etnry by abadger · Pull Request #67866 · ansible/ansible · GitHub |
CONFIRM |
github.com |
Patch, Third Party Advisory |
| Debian -- Security Information -- DSA-4950-1 ansible |
DEBIAN |
www.debian.org |
|
| 1805491 – (CVE-2020-1746) CVE-2020-1746 ansible: Information disclosure issue in ldap_attr and ldap_entry modules |
CONFIRM |
bugzilla.redhat.com |
Issue Tracking, Vendor Advisory |
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 178744 Debian Security Update for ansible (DSA 4950-1)
- 356226 Amazon Linux Security Advisory for ansible : ALASANSIBLE2-2023-008
- 500010 Alpine Linux Security Update for ansible
- 501350 Alpine Linux Security Update for ansible-base
- 980401 Python (pip) Security Update for ansible (GHSA-j2h6-73x8-22c4)
