Log in Start free

Vulnerability · Published Feb 6, 2024 · Assigned by redhat

CVE-2024-0690Ansible-core: possible information leak in tasks that ignore ansible_no_log configuration

Medium 5.0

In plain English

A medium-severity security flaw in ansible. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.0Medium
Exploit odds (30 days)0.3%top 76.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG configuration in some scenarios. Information is still included in the output in certain tasks, such as loop items. Depending on the task, this issue may include sensitive information, such as decrypted secret values.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8ansible-core2.16.3-2.el8ALSA-2024:3043
AlmaLinux:9ansible-core1:2.14.14-1.el9ALSA-2024:2246
AlmaLinux:8ansible-test2.16.3-2.el8ALSA-2024:3043
AlmaLinux:9ansible-test1:2.14.14-1.el9ALSA-2024:2246
Debian:12ansible5.4.0-1DEBIAN-CVE-2024-0690
Debian:13ansible5.4.0-1DEBIAN-CVE-2024-0690
Debian:14ansible5.4.0-1DEBIAN-CVE-2024-0690
Debian:12ansible-core2.14.16-0+deb12u1DEBIAN-CVE-2024-0690
Debian:13ansible-core2.16.5-1DEBIAN-CVE-2024-0690
Debian:14ansible-core2.16.5-1DEBIAN-CVE-2024-0690
PyPIansible-core2.16.3GHSA-h24r-m9qc-pvpg
PyPIansible-core2.14.4, 2.15.9, 2.16.3PYSEC-2024-36
PyPIansible-core2.14.14GHSA-h24r-m9qc-pvpg
PyPIansible-core2.15.9GHSA-h24r-m9qc-pvpg
Rocky Linux:8ansible-core0:2.16.3-2.el8RLSA-2024:3043
Ubuntu:24.04:LTSansibleno fix listedUBUNTU-CVE-2024-0690
Ubuntu:25.10ansibleno fix listedUBUNTU-CVE-2024-0690
Ubuntu:26.04:LTSansibleno fix listedUBUNTU-CVE-2024-0690
Ubuntu:26.10ansibleno fix listedUBUNTU-CVE-2024-0690
Ubuntu:22.04:LTSansible-coreno fix listedUBUNTU-CVE-2024-0690
Ubuntu:24.04:LTSansible-coreno fix listedUBUNTU-CVE-2024-0690
Ubuntu:25.10ansible-coreno fix listedUBUNTU-CVE-2024-0690
Ubuntu:26.04:LTSansible-coreno fix listedUBUNTU-CVE-2024-0690
Ubuntu:26.10ansible-coreno fix listedUBUNTU-CVE-2024-0690

Affected products (as reported)

VendorProductVersions
ansible 2.14.0 – before 2.14.42.15.0 – before 2.15.92.16.0 – before 2.16.3
Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 8 see references
Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 8 see references
Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 8 see references
Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 9 see references
Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 9 see references
Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 9 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 9 see references

Weakness: CWE-117 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

References