CVE-2017-7550 Ansible Insertion of Sensitive Information into Log File vulnerability
CriticalCVSS 9.8
EPSS 3.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkins_plugin module. Remote attackers could use this flaw to expose sensitive information from a remote host's logs. This flaw was fixed by not allowing passwords to be specified in the "params" argument, and noting this in the module documentation.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi ansible(PyPI) | >= 2.4.0.0, < 2.4.1.0 | 2.4.1.0 |
| pypi ansible(PyPI) | = 2.4.0.0 | No fix listed |
| pypi ansible(PyPI) | >= 2.3.0.0, < 2.3.3.0 | 2.3.3.0 |
| pypi ansible(PyPI) | = 2.3.0.0 | No fix listed |
| pypi ansible(PyPI) | = 2.3.1.0 | No fix listed |
| pypi ansible(PyPI) | = 2.3.2.0 | No fix listed |
| debian/ansible(Debian:12) | < 2.4.2.0+dfsg-1 | 2.4.2.0+dfsg-1 |
| debian/ansible(Debian:13) | < 2.4.2.0+dfsg-1 | 2.4.2.0+dfsg-1 |
| debian/ansible(Debian:14) | < 2.4.2.0+dfsg-1 | 2.4.2.0+dfsg-1 |
| redhat ansible | >= 2.3.0, < 2.3.3 | 2.3.3 |
| redhat ansible | >= 2.4.0, < 2.4.1 | 2.4.1 |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat ansible | = 2.3.x before 2.3.3, 2.4.x before 2.4.1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com issue-tracking third-party-advisory
- github.com patch
- RHSA-2017:2966 issue-tracking third-party-advisory vendor-advisory
- access.redhat.com
- bugzilla.redhat.com issue-tracking third-party-advisory
- github.com product
- github.com
- github.com vendor-advisory
- Debian Security Tracker CVE-2017-7550 vendor-advisory