5.0
Medium
CVE-2024-0690 Ansible-core: possible information leak in tasks that ignore ansible_no_log configuration
Description
An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG configuration in some scenarios. Information is still included in the output in certain tasks, such as loop items. Depending on the task, this issue may include sensitive information, such as decrypted secret values.
CVSS 3.1 detail
Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:NExploitable with local access to the machine, with an ordinary account and if a user takes an action; an attacker can seriously compromise confidentiality, integrity or availability.
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- Low
- Interaction
- Required
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Ansible Automation Platform 2.4 for RHEL 8 | Versions not published | |
| Red Hat Ansible Automation Platform 2.4 for RHEL 9 | Versions not published | |
| Red Hat Enterprise Linux 8 | Versions not published | |
| Red Hat Enterprise Linux 9 | Versions not published |
References
- RHSA-2024:0733 access.redhat.com
- RHSA-2024:2246 access.redhat.com
- RHSA-2024:3043 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2259013 bugzilla.redhat.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of Red Hat Ansible Automation Platform 2.4 for RHEL 8
The 21 CVEs of Red Hat Ansible Automation Platform 2.4 for RHEL 8 →
CVE-2026-84719
Automation-controller: automation-controller: workflowjobtemplate /copy/ deep-copy sanitizer omits instance_groups authorization (instancegroup use_role bypass to control-plane)
9.9
Critical
CVE-2026-75884
Awx: awx: privilege escalation to openshift namespace via pod_spec_override injection in container groups
9.1
Critical
CVE-2026-84502
Automation-controller: automation-controller-container: automation-controller: project scm_url argument injection into `git ls-remote --upload-pack` yields rce on the controller-task control-plane pod
9.9
Critical
CVE-2026-84474
Automation-controller: automation-controller-container: automation-controller: view_jobtemplate to execute privilege escalation via host_config_key exposure and x-forwarded-for spoofing of provisioning-callback host match
9.9
Critical