5.0
Moyenne
CVE-2020-1753 A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions…
Description
A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prior to 2.8.11 and all Ansible 2.9.x versions prior to 2.9.7, when managing kubernetes using the k8s module. Sensitive parameters such as passwords and tokens are passed to kubectl from the command line, not using an environment variable or an input configuration file. This will disclose passwords and tokens from process list and no_log directive from debug module would not have any effect making these secrets being disclosed on stdout and log files.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Ansible | Versions non publiées |
Références
- bugzilla.redhat.com bugzilla.redhat.com
- github.com github.com
- FEDORA-2020-1b6ce91e37 lists.fedoraproject.org
- FEDORA-2020-3990f03ba3 lists.fedoraproject.org
- FEDORA-2020-f80154b5b4 lists.fedoraproject.org
- GLSA-202006-11 security.gentoo.org
- DSA-4950 www.debian.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de Ansible
Les 29 CVE de Ansible →
CVE-2020-14332
A flaw was found in the Ansible Engine when using module_args
5.5
Moyenne
CVE-2020-14330
An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data…
5.0
Moyenne
CVE-2020-10744
An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running…
5.0
Moyenne
CVE-2020-1746
A flaw was found in the Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and…
5.0
Moyenne