Red Hat ansible
En bref
- Source
- NVD
- EPSS
- EPSS 0.39 % · centile 34 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- redhat
- Statut NVD
- Modified
Description
A flaw was found in the Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when the ldap_attr and ldap_entry community modules are used. The issue discloses the LDAP bind password to stdout or a log file if a playbook task is written using the bind_pw in the parameters field. The highest threat from this vulnerability is data confidentiality.
Faiblesses (CWE)
- CWE-200 — Exposition d'informations sensibles à un acteur non autorisé
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.0 | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N | redhat |
| CVSS 3.1 | MEDIUM 5.0 | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N | NVD · secalert@redhat.com (Secondary) |
| CVSS 3.1 | MEDIUM 5.0 | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | LOW 1.9 | AV:L/AC:M/Au:N/C:P/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-j2h6-73x8-22c4 — Exposure of Sensitive Information to an Unauthorized Actor in ansible
- PYSEC-2020-13 — A flaw was found in the Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible T
Références européennes
- ENISA EUVD · EUVD-2020-0006
- GCVE · GCVE-0-2020-1746
Configurations affectées (CPE NVD)
cpe:2.3:a:redhat:ansible_engine:*:*:*:*:*:*:*:*≥ 2.7.0 < 2.7.17cpe:2.3:a:redhat:ansible_engine:*:*:*:*:*:*:*:*≥ 2.8.0 < 2.8.11cpe:2.3:a:redhat:ansible_engine:*:*:*:*:*:*:*:*≥ 2.9.0 < 2.9.7cpe:2.3:a:redhat:ansible_tower:*:*:*:*:*:*:*:*≥ 3.4.0 ≤ 3.4.5cpe:2.3:a:redhat:ansible_tower:*:*:*:*:*:*:*:*≥ 3.5.0 ≤ 3.5.5cpe:2.3:a:redhat:ansible_tower:*:*:*:*:*:*:*:*≥ 3.6.0 ≤ 3.6.3cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| Red Hat · ansible | affected ansible-engine versions 2.7.x before 2.7.17 ; affected ansible-engine versions 2.8.x before 2.8.11 ; affected ansible-engine versions 2.9.x before 2.9.7 ; affected Ansible Tower <= 3.4.5 ; affected Ansible Tower <= 3.5.5 ; affected Ansible Tower <= 3.6.3 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |