CoreCVE
Back

HIGH

Ansible-core: exposure of sensitive information in ansible vault files due to improper logging

Published Sep 14, 2024

Description

A flaw was found in Ansible, where sensitive information stored in Ansible Vault files can be exposed in plaintext during the execution of a playbook. This occurs when using tasks such as include_vars to load vaulted variables without setting the no_log: true parameter, resulting in sensitive data being printed in the playbook output or logs. This can lead to the unintentional disclosure of secrets like passwords or API keys, compromising security and potentially allowing unauthorized access or actions.

Affected products

Remediation

Vendor solution

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Red Hat statement

This issue is classified as moderate rather than important because while it does expose sensitive information during playbook execution, the exposure is limited to logs and output generated during the run, which is typically accessible only to authorized users with sufficient privileges. The flaw does not result in an immediate or direct compromise of systems, as no remote exploitation vector is introduced. Additionally, the risk can be mitigated through proper configuration (`no_log: true`) and access control measures, reducing the likelihood of unauthorized access to the logged data. However, the unintentional disclosure of secrets like passwords or API keys still presents a potential risk for privilege escalation or lateral movement within an environment, justifying a moderate severity rating.

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Weaknesses (1)

CWE-532

References (14)

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED
Assigner redhat
Published Sep 14, 2024
Updated Sep 17, 2026
Reserved Sep 13, 2024
Link CVE-2024-8775

CISA Vulnrichment

Updated Sep 16, 2024

NVD

Status Deferred
Modified Sep 17, 2026
Link CVE-2024-8775

Red Hat

Severity Moderate
Public date Sep 13, 2024
Bugzilla 2312119
Link CVE-2024-8775

ENISA EUVD

Assigner redhat
Published Sep 14, 2024
Updated Sep 17, 2026
Link EUVD-2024-2826

GitHub

Link GHSA-JPXC-VMJF-9FCJ