CVE-2024-0690 Ansible-core: possible information leak in tasks that ignore ansible_no_log configuration

2024-02-0612:00:28

CWE-117

redhat

github.com

cve-2024-0690

ansible-core

information leak

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

AI Score

6.1

Confidence

Low

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG configuration in some scenarios. Information is still included in the output in certain tasks, such as loop items. Depending on the task, this issue may include sensitive information, such as decrypted secret values.