Ansible-core: possible information leak in tasks that ignore ansible_no_log configuration
Summary
| CVE | CVE-2024-0690 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2024-02-06 12:15:55 UTC |
| Updated | 2026-11-05 12:17:42 UTC |
| Description | An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG configuration in some scenarios. Information is still included in the output in certain tasks, such as loop items. Depending on the task, this issue may include sensitive information, such as decrypted secret values. |
Risk And Classification
Primary CVSS: v3.1 5.5 MEDIUM from [email protected]
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Problem Types: CWE-117 | CWE-116 | CWE-117 Improper Output Neutralization for Logs
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 5.5 | MEDIUM | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| 3.1 | [email protected] | Secondary | 5 | MEDIUM | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N |
| 3.1 | CNA | CVSS | 5 | MEDIUM | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N |
CVSS v3.1 Breakdown
Attack Vector
LocalAttack Complexity
LowPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
NoneAvailability
NoneCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD Known Affected Configurations (CPE 2.3)
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Red Hat | Red Hat Ansible Automation Platform 2.4 For RHEL 8 | unaffected 1:2.15.9-1.el8ap * rpm | Not specified |
| CNA | Red Hat | Red Hat Ansible Automation Platform 2.4 For RHEL 8 | unaffected 1:2.15.9-1.el8ap * rpm | Not specified |
| CNA | Red Hat | Red Hat Ansible Automation Platform 2.4 For RHEL 8 | unaffected 1:2.15.9-1.el8ap * rpm | Not specified |
| CNA | Red Hat | Red Hat Ansible Automation Platform 2.4 For RHEL 9 | unaffected 1:2.15.9-1.el9ap * rpm | Not specified |
| CNA | Red Hat | Red Hat Ansible Automation Platform 2.4 For RHEL 9 | unaffected 1:2.15.9-1.el9ap * rpm | Not specified |
| CNA | Red Hat | Red Hat Ansible Automation Platform 2.4 For RHEL 9 | unaffected 1:2.15.9-1.el9ap * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8 | unaffected 0:2.16.3-2.el8 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9 | unaffected 1:2.14.14-1.el9 * rpm | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| bugzilla.redhat.com/show_bug.cgi | af854a3a-2127-422b-91ae-364da2661108 | bugzilla.redhat.com | Issue Tracking |
| access.redhat.com/errata/RHSA-2024:2246 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| github.com/ansible/ansible/pull/82565 | af854a3a-2127-422b-91ae-364da2661108 | github.com | Issue Tracking, Patch |
| lists.fedoraproject.org/archives/list/[email protected]/messag... | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| security.netapp.com/advisory/ntap-20250117-0001 | af854a3a-2127-422b-91ae-364da2661108 | security.netapp.com | |
| access.redhat.com/security/cve/CVE-2024-0690 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | Vendor Advisory |
| access.redhat.com/errata/RHSA-2024:3043 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| lists.fedoraproject.org/archives/list/[email protected]/messag... | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| access.redhat.com/errata/RHSA-2024:0733 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2024-01-18T00:00:00.000Z | Reported to Red Hat. |
| CNA | 2024-01-18T00:00:00.000Z | Made public. |
Workarounds
CNA: Explicitly setting 'no_log' within the playbook will prevent the output from containing potentially sensitive information.