CVE-2024-0690mediumCWE-117

CVE-2024-0690: falha de média gravidade em ansible

Ansible-core: possible information leak in tasks that ignore ansible_no_log configuration

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Red Hat Enterprise Linux+ Monitorar Red Hat Ansible Automation Platform

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5epss 0.3%
An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG configuration in some scenarios. Information is still included in the output in certain tasks, such as loop items. Depending on the task, this issue may include sensitive information, such as decrypted secret values.
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Produtos afetados
ansibleRed Hat · Red Hat Ansible Automation Platform 2.4 for RHEL 8Red Hat · Red Hat Ansible Automation Platform 2.4 for RHEL 9Red Hat · Red Hat Enterprise Linux 8Red Hat · Red Hat Enterprise Linux 9
CVEs relacionadas — ansible

No mesmo produto, das mais perigosas para as menos.

CVE-2024-1394HIGHGolang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloadsEPSS 1.5%CVE-2023-5115MEDIUMAnsible: malicious role archive can cause ansible-galaxy to overwrite arbitrary filesEPSS 1.0%CVE-2023-5189MEDIUMHub: insecure galaxy-importer tarfile extractionEPSS 1.0%CVE-2023-3971HIGHController: html injection in custom login infoEPSS 0.8%CVE-2026-84474CRITICALAutomation-controller: automation-controller-container: automation-controller: view_jobtemplate to execute privilege escalation via host_config_key exposure and x-forwarded-for spoofing of provisioning-callback host matchEPSS 0.8%CVE-2023-4380MEDIUMPlatform: token exposed at importing projectEPSS 0.6%