CVE-2024-0690mediumCWE-117

CVE-2024-0690: fallo de gravedad media en ansible

Ansible-core: possible information leak in tasks that ignore ansible_no_log configuration

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Red Hat Enterprise Linux+ Monitorear Red Hat Ansible Automation Platform

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5epss 0.3%
An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG configuration in some scenarios. Information is still included in the output in certain tasks, such as loop items. Depending on the task, this issue may include sensitive information, such as decrypted secret values.
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Productos afectados
ansibleRed Hat · Red Hat Ansible Automation Platform 2.4 for RHEL 8Red Hat · Red Hat Ansible Automation Platform 2.4 for RHEL 9Red Hat · Red Hat Enterprise Linux 8Red Hat · Red Hat Enterprise Linux 9
CVEs relacionadas — ansible

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-1394HIGHGolang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloadsEPSS 1.5%CVE-2023-5115MEDIUMAnsible: malicious role archive can cause ansible-galaxy to overwrite arbitrary filesEPSS 1.0%CVE-2023-5189MEDIUMHub: insecure galaxy-importer tarfile extractionEPSS 1.0%CVE-2023-3971HIGHController: html injection in custom login infoEPSS 0.8%CVE-2026-84474CRITICALAutomation-controller: automation-controller-container: automation-controller: view_jobtemplate to execute privilege escalation via host_config_key exposure and x-forwarded-for spoofing of provisioning-callback host matchEPSS 0.8%CVE-2023-4380MEDIUMPlatform: token exposed at importing projectEPSS 0.6%