A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prior to 2.8.11 and all
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 2.7.18, 2.8.11, 2.9.7, 2.8.12
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prior to 2.8.11 and all Ansible 2.9.x versions prior to 2.9.7, when managing kubernetes using the k8s module. Sensitive parameters such as passwords and tokens are passed to kubectl from the command line, not using an environment variable or an input configuration file. This will disclose passwords and tokens from process list and no_log directive from debug module would not have any effect making these secrets being disclosed on stdout and log files.
Timeline
- CVE published
- Record last updated
Affected versions
- Red Hat Ansible
all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prior to 2.8.11, all Ansible 2.9.x versions prior to 2.9.7
- ansiblePyPI
fixed in 2.7.18; From 2.8.0 · fixed in 2.8.11; From 2.9.0 · fixed in 2.9.7
- ansiblePyPI
From 2.7.0a1 · fixed in 2.7.18
- ansiblePyPI
From 2.8.0a1 · fixed in 2.8.12
- ansiblePyPI
From 2.9.0a1 · fixed in 2.9.7