Ansible-core information disclosure flaw

中 5.5CVE-2024-0690 · GHSA-h24r-m9qc-pvpg · PYSEC-2024-36 · 06/02/2024 公開 · 17/06/2026 更新

要点

CVE-2024-0690 は ansible-core, ansible (redhat), ansible automation platform (redhat) に影響する深刻度「中」 (CVSS 5.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.30%（全脆弱性の 23.2% より高い）。
対処：2.15.9, 2.16.3, 2.14.14, 2.14.4 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
ansible-core PyPI	`≥ 2.15.0, < 2.15.9≥ 2.16.0, < 2.16.3< 2.14.14< 2.14.4`	`2.15.92.16.32.14.142.14.4`
ansible redhat	`≥ 2.15.0, < 2.15.9≥ 2.16.0, < 2.16.3< 2.14.4`	`2.15.92.16.32.14.4`
ansible automation platform redhat	`= 2.4`	修正版なし
ansible developer redhat	`= 1.1`	修正版なし
ansible inside redhat	`= 1.2`	修正版なし

概要

An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG configuration in some scenarios. It was discovered that information is still included in the output in certain tasks, such as loop items. Depending on the task, this issue may include sensitive information, such as decrypted secret values.

NVD の説明

An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG configuration in some scenarios. Information is still included in the output in certain tasks, such as loop items. Depending on the task, this issue may include sensitive information, such as decrypted secret values.