CVE-2024-0690

MEDIUM

ansible-core < 2.14.14 - Information Disclosure via ANSIBLE_NO_LOG Bypass

Title source: llm
STIX 2.1

Description

An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG configuration in some scenarios. Information is still included in the output in certain tasks, such as loop items. Depending on the task, this issue may include sensitive information, such as decrypted secret values.

References (9)

Core 9
Core References
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2024:0733
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2024:2246
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2024:3043
Vendor Advisory vdb-entry x_refsource_redhat
https://access.redhat.com/security/cve/CVE-2024-0690
Issue Tracking issue-tracking x_refsource_redhat
https://bugzilla.redhat.com/show_bug.cgi?id=2259013

Scores

CVSS v3 5.0
EPSS 0.0030
EPSS Percentile 21.6%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-116 CWE-117
Status published
Products (11)
fedoraproject/fedora 38
fedoraproject/fedora 39
pypi/ansible-core 0 - 2.14.14PyPI
pypi/ansible-core 2.15.0 - 2.15.9PyPI
pypi/ansible-core 2.16.0 - 2.16.3PyPI
redhat/ansible < 2.14.4
redhat/ansible_automation_platform 2.4
redhat/ansible_developer 1.1
redhat/ansible_inside 1.2
redhat/enterprise_linux 8.0
... and 1 more
Published Feb 06, 2024
Tracked Since Feb 18, 2026