Fluid Attacks Database

Description

Ansible Insertion of Sensitive Information into Log File vulnerability A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkins_plugin module. Remote attackers could use this flaw to expose sensitive information from a remote host's logs. This flaw was fixed by not allowing passwords to be specified in the "params" argument, and noting this in the module documentation.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 11	ansible	>=0 <2.4.2.0+dfsg-1	2.4.2.0+dfsg-1
debian 14	ansible	>=0 <2.4.2.0+dfsg-1	2.4.2.0+dfsg-1
debian 13	ansible	>=0 <2.4.2.0+dfsg-1	2.4.2.0+dfsg-1
pypi	ansible	>=2.4.0.0 <2.4.1.0 \|\| >=2.3.0.0 <2.3.3.0	2.4.1.0, 2.3.3.0
debian 12	ansible	>=0 <2.4.2.0+dfsg-1	2.4.2.0+dfsg-1

Aliases

1. CVE-2017-75502. NVD-2017-75503. OSV-DEBIAN-2017-75504. OSV-2017-75505. GCVE-2017-75506. SECURITY-TRACKER-CVE-2017-75507. access.redhat.com8. ACCESS-CVE-2017-7550

References

1. https://github.com/ansible/ansible/issues/308742. https://github.com/ansible/ansible/commit/facbf7f14da29eea67ef68ab386fc15bd06d7c7f3. https://bugzilla.redhat.com/show_bug.cgi?id=14736454. https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2017-4.yaml

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.