GHSA-4r65-35qq-ch8jMediumCVSS 5.5

Ansible discloses sensitive information in traceback error message

Published
March 4, 2022
Last Modified
September 9, 2024

🔗 CVE IDs covered (1)

📋 Description

Ansible is an IT automation system that handles configuration management, application deployment, cloud provisioning, ad-hoc task execution, network automation, and multi-node orchestration. A flaw was found in Ansible Engine's ansible-connection module where sensitive information, such as the Ansible user credentials, is disclosed by default in the traceback error message when Ansible receives an unexpected response from set_options. The highest threat from this vulnerability is confidentiality.

🎯 Affected products1

  • pip/ansible:< 2.9.27

🔗 References (13)