Kurz gesagt
- CVE-2017-7550 ist eine Schwachstelle (KRITISCH (CVSS 9.8)) in ansible, ansible (redhat).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 3.6%, höher als bei 89.3% aller Schwachstellen.
- Abhilfe: auf 2.3.3.0, 2.4.1.0, 2.3.3, 2.4.1 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| ansible PyPI | ≥ 2.3.0.0, < 2.3.3.0≥ 2.4.0.0, < 2.4.1.0
| 2.3.3.02.4.1.0
|
| ansible | ≥ 2.3.0, < 2.3.3≥ 2.4.0, < 2.4.1
| 2.3.32.4.1
|
Description
A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkins_plugin module. Remote attackers could use this flaw to expose sensitive information from a remote host's logs. This flaw was fixed by not allowing passwords to be specified in the "params" argument, and noting this in the module documentation.
NVD description
A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkins_plugin module. Remote attackers could use this flaw to expose sensitive information from a remote host's logs. This flaw was fixed by not allowing passwords to be specified in the "params" argument, and noting this in the module documentation.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free