CVE-2025-14010
Ansible-collection-community-general: ansible-collection-community-general: keycloak user module leaks credentials in verbose output
MEDIUM 5.5
En bref
- Source
- NVD
- EPSS
- EPSS 0.19 % · centile 8 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- redhat
- Statut NVD
- Modified
Description
A flaw was found in ansible-collection-community-general. This vulnerability allows for information exposure (IE) of sensitive credentials, specifically plaintext passwords, via verbose output when running Ansible with debug modes. Attackers with access to logs could retrieve these secrets and potentially compromise Keycloak accounts or administrative access.
Faiblesses (CWE)
- CWE-532 — Informations sensibles insérées dans un fichier de journal
Références
- https://access.redhat.com/security/cve/CVE-2025-14010
- https://bugzilla.redhat.com/show_bug.cgi?id=2418774
- https://github.com/ansible-collections/community.general/issues/11000
- https://github.com/ansible-collections/community.general/pull/11005
- https://github.com/ansible-community/ansible-build-data/blob/main/12/CHANGELOG-v12.md#security-fixes
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | redhat |
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | NVD · secalert@redhat.com (Secondary) |
Avis
- GHSA-8ggh-xwr9-3373 — Ansible Community General Collection is vulnerable to exposure of sensitive information
- PYSEC-2026-1119 — Ansible Community General Collection is vulnerable to exposure of sensitive information
Références européennes
- ENISA EUVD · EUVD-2025-201152
- GCVE · GCVE-0-2025-14010
Configurations affectées (CPE NVD)
cpe:2.3:a:redhat:community.general:-:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| ansible-collections · Ansible Community General Collection | affected 7.1.0 < 9.5.13 ; affected 10.0.0 < 10.7.6 ; affected 11.0.0 < 11.4.1 ; affected 12.0.0 < 12.2.0 |
| Red Hat · Red Hat Ceph Storage 5 | |
| Red Hat · Red Hat Ceph Storage 6 | |
| Red Hat · Red Hat Ceph Storage 7 | |
| Red Hat · Red Hat Ceph Storage 8 | |
| Red Hat · Red Hat OpenStack Platform 17.1 | |
| Red Hat · Red Hat OpenStack Platform 18.0 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |