CVE-2024-0690mediumCWE-117

CVE-2024-0690: medium-severity vulnerability in ansible

Ansible-core: possible information leak in tasks that ignore ansible_no_log configuration

Published · Updated

Follow this CVE+ Monitor Red Hat Enterprise Linux+ Monitor Red Hat Ansible Automation Platform

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5epss 0.3%
An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG configuration in some scenarios. Information is still included in the output in certain tasks, such as loop items. Depending on the task, this issue may include sensitive information, such as decrypted secret values.
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Affected products
ansibleRed Hat · Red Hat Ansible Automation Platform 2.4 for RHEL 8Red Hat · Red Hat Ansible Automation Platform 2.4 for RHEL 9Red Hat · Red Hat Enterprise Linux 8Red Hat · Red Hat Enterprise Linux 9
Related CVEs — ansible

In the same product, most dangerous first.

CVE-2024-1394HIGHGolang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloadsEPSS 1.5%CVE-2023-5115MEDIUMAnsible: malicious role archive can cause ansible-galaxy to overwrite arbitrary filesEPSS 1.0%CVE-2023-5189MEDIUMHub: insecure galaxy-importer tarfile extractionEPSS 1.0%CVE-2023-3971HIGHController: html injection in custom login infoEPSS 0.8%CVE-2026-84474CRITICALAutomation-controller: automation-controller-container: automation-controller: view_jobtemplate to execute privilege escalation via host_config_key exposure and x-forwarded-for spoofing of provisioning-callback host matchEPSS 0.8%CVE-2023-4380MEDIUMPlatform: token exposed at importing projectEPSS 0.6%