CVE-2024-0690CWE-117

Ansible-core: possible information leak in tasks that ignore ansible_no_log configuration

Medium · published February 6, 2024

CVSS v3.1
5.0
EPSS
0%
Percentile
22.0
In the wild
Unconfirmed
What it is

An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG configuration in some scenarios. Information is still included in the output in certain tasks, such as loop items. Depending on the task, this issue may include sensitive information, such as decrypted secret values.

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00304 · 22.0th percentile
Weakness
CWE-117 · Improper Output Neutralization for Logs
Published
2024-02-06T12:00Z
EPSS history
Timeline
  • 06 FEB 12:00Z
    Ansible-core: possible information leak in tasks that ignore ansible_no_log configuration
    cvelistv5