VulnerabilityModified
CVE-2024-0690
An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG configuration in some scenarios.
MEDIUM 5.5EPSS 0.30%
Does this matter?
Lower severity and a low EPSS score (0.30%). Track it; it rarely justifies an emergency change on its own.
Description
An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG configuration in some scenarios. Information is still included in the output in certain tasks, such as loop items. Depending on the task, this issue may include sensitive information, such as decrypted secret values.
- CVSS 3.1
- 5.5 MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 0.30% probability · 23th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-117, CWE-116
- Affected
- redhat/ansible · redhat/enterprise linux · redhat/ansible automation platform · redhat/ansible developer · redhat/ansible inside · fedoraproject/fedora
- Source
- secalert@redhat.com
References
- https://access.redhat.com/errata/RHSA-2024:0733Vendor Advisory
- https://access.redhat.com/errata/RHSA-2024:2246
- https://access.redhat.com/errata/RHSA-2024:3043
- https://access.redhat.com/security/cve/CVE-2024-0690Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2259013Issue Tracking
- https://github.com/ansible/ansible/pull/82565Issue Tracking, Patch
- https://access.redhat.com/errata/RHSA-2024:0733Vendor Advisory
- https://access.redhat.com/errata/RHSA-2024:2246
- https://access.redhat.com/errata/RHSA-2024:3043
- https://access.redhat.com/security/cve/CVE-2024-0690Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2259013Issue Tracking
- https://github.com/ansible/ansible/pull/82565Issue Tracking, Patch
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IZQGCRDSZL7ONCULMB6ZUHOE4L44KIBP/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VDYSWOCPZMNRU5LWKIEBW4WGWLMTU7WQ/
- https://security.netapp.com/advisory/ntap-20250117-0001/
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.