5.5

CVE-2024-8775

Ansible-core: exposure of sensitive information in ansible vault files due to improper logging

A flaw was found in Ansible, where sensitive information stored in Ansible Vault files can be exposed in plaintext during the execution of a playbook. This occurs when using tasks such as include_vars to load vaulted variables without setting the no_log: true parameter, resulting in sensitive data being printed in the playbook output or logs. This can lead to the unintentional disclosure of secrets like passwords or API keys, compromising security and potentially allowing unauthorized access or actions.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
Collection URLhttps://github.com/ansible/ansible
≫
Paket ansible-core
Default Statusunaffected
Version <= 2.17.4
Version 1.0.0
Status affected
HerstellerRed Hat
≫
Produkt Ansible Automation Platform Execution Environments
Default Statusaffected
Version 3.0.1-96
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Ansible Automation Platform Execution Environments
Default Statusaffected
Version 3.0.1-95
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Ansible Automation Platform Execution Environments
Default Statusaffected
Version 2.9.27-32
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Ansible Automation Platform Execution Environments
Default Statusaffected
Version 2.14.13-21
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Ansible Automation Platform Execution Environments
Default Statusaffected
Version 2.17.6-2
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Discovery 1 for RHEL 9
Default Statusaffected
Version 1.12.0-1
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Discovery 1 for RHEL 9
Default Statusaffected
Version 1.12.0-1
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Ansible Automation Platform 2.4 for RHEL 8
Default Statusaffected
Version 1:2.15.13-1.el8ap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Ansible Automation Platform 2.4 for RHEL 9
Default Statusaffected
Version 1:2.15.13-1.el9ap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Ansible Automation Platform 2.5 for RHEL 8
Default Statusaffected
Version 1:2.16.13-1.el8ap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Ansible Automation Platform 2.5 for RHEL 9
Default Statusaffected
Version 1:2.16.13-1.el9ap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Enterprise Linux 10
Default Statusaffected
HerstellerRed Hat
≫
Produkt Red Hat Enterprise Linux AI (RHEL AI)
Default Statusaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.04% 0.106
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
secalert@redhat.com 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE-532 Insertion of Sensitive Information into Log File

The product writes sensitive information to a log file.