Log in Start free

Vulnerability · Published Sep 14, 2024 · Assigned by redhat

CVE-2024-8775Ansible-core: exposure of sensitive information in ansible vault files due to improper logging

Medium 5.5

In plain English

A medium-severity sensitive data in logs in ansible-core. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.3%top 80.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in Ansible, where sensitive information stored in Ansible Vault files can be exposed in plaintext during the execution of a playbook. This occurs when using tasks such as include_vars to load vaulted variables without setting the no_log: true parameter, resulting in sensitive data being printed in the playbook output or logs. This can lead to the unintentional disclosure of secrets like passwords or API keys, compromising security and potentially allowing unauthorized access or actions.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12ansible5.4.0-1DEBIAN-CVE-2024-8775
Debian:13ansible5.4.0-1DEBIAN-CVE-2024-8775
Debian:14ansible5.4.0-1DEBIAN-CVE-2024-8775
Debian:12ansible-core2.14.18-0+deb12u1DEBIAN-CVE-2024-8775
Debian:13ansible-core2.17.5-5DEBIAN-CVE-2024-8775
Debian:14ansible-core2.17.5-5DEBIAN-CVE-2024-8775
PyPIansible-core2.17.6GHSA-jpxc-vmjf-9fcj
PyPIansible-core2.16.13GHSA-jpxc-vmjf-9fcj
PyPIansible-core2.16.13, 2.17.6PYSEC-2026-1124
Ubuntu:24.04:LTSansibleno fix listedUBUNTU-CVE-2024-8775
Ubuntu:25.10ansibleno fix listedUBUNTU-CVE-2024-8775
Ubuntu:26.04:LTSansibleno fix listedUBUNTU-CVE-2024-8775
Ubuntu:26.10ansibleno fix listedUBUNTU-CVE-2024-8775
Ubuntu:22.04:LTSansible-coreno fix listedUBUNTU-CVE-2024-8775
Ubuntu:24.04:LTSansible-coreno fix listedUBUNTU-CVE-2024-8775
Ubuntu:25.10ansible-coreno fix listedUBUNTU-CVE-2024-8775
Ubuntu:26.04:LTSansible-coreno fix listedUBUNTU-CVE-2024-8775
Ubuntu:26.10ansible-coreno fix listedUBUNTU-CVE-2024-8775

Affected products (as reported)

VendorProductVersions
ansible-core 1.0.0 – through 2.17.4
Red Hat Ansible Automation Platform Execution Environments see references
Red Hat Ansible Automation Platform Execution Environments see references
Red Hat Ansible Automation Platform Execution Environments see references
Red Hat Ansible Automation Platform Execution Environments see references
Red Hat Ansible Automation Platform Execution Environments see references
Red Hat Discovery 1 for RHEL 9 see references
Red Hat Discovery 1 for RHEL 9 see references
Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 8 see references
Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 8 see references
Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 8 see references
Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 9 see references
Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 9 see references
Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 9 see references
Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 see references
Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 see references
Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 see references
Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 see references
Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 see references
Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 see references
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux AI (RHEL AI) see references

Weakness: CWE-532 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References