CVE-2020-14332
11.09.2020, 18:15
A flaw was found in the Ansible Engine when using module_args. Tasks executed with check mode (--check-mode) do not properly neutralize sensitive data exposed in the event data. This flaw allows unauthorized users to read this data. The highest threat from this vulnerability is to confidentiality.Enginsight
| Vendor | Product | Version |
|---|---|---|
| redhat | ansible_engine | 2.8.0 ≤ 𝑥 < 2.8.14 |
| redhat | ansible_engine | 2.9.0 ≤ 𝑥 < 2.9.12 |
| debian | debian_linux | 10.0 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Common Weakness Enumeration
- CWE-117 - Improper Output Neutralization for LogsThe software does not neutralize or incorrectly neutralizes output that is written to logs.
- CWE-532 - Insertion of Sensitive Information into Log FileInformation written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
References