CVE-2024-8775

NameCVE-2024-8775
DescriptionA flaw was found in Ansible, where sensitive information stored in Ansible Vault files can be exposed in plaintext during the execution of a playbook. This occurs when using tasks such as include_vars to load vaulted variables without setting the no_log: true parameter, resulting in sensitive data being printed in the playbook output or logs. This can lead to the unintentional disclosure of secrets like passwords or API keys, compromising security and potentially allowing unauthorized access or actions.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1082851

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
ansible (PTS)jessie, jessie (lts)1.7.2+dfsg-2+deb8u3vulnerable
stretch (security), stretch (lts), stretch2.2.1.0-2+deb9u3vulnerable
buster (security), buster, buster (lts)2.7.7+dfsg-1+deb10u2vulnerable
bullseye2.10.7+merged+base+2.10.17+dfsg-0+deb11u1vulnerable
bookworm7.7.0+dfsg-3+deb12u1fixed
sid, trixie10.6.0+dfsg-1fixed
ansible-core (PTS)bookworm2.14.16-0+deb12u1vulnerable
trixie2.17.5-5fixed
sid2.18.0-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
ansiblesourcestretch(unfixed)end-of-life
ansiblesource(unstable)5.4.0-1
ansible-coresource(unstable)2.17.5-51082851

Notes

[bookworm] - ansible-core <no-dsa> (Minor issue)
ansible-core was split off from src:ansible with 4.6.0-1 in experimental/5.4.0-1 in sid
https://bugzilla.redhat.com/show_bug.cgi?id=2312119
Ansible bug: https://github.com/ansible/ansible/pull/84179
Fixed by: https://github.com/ansible/ansible/commit/23f8639a4b01f6437f241d835efb68b8b7150575 (v2.18.0rc2)
Fixed by: https://github.com/ansible/ansible/commit/4a654435470c88a5732af5d647d0014b2eea2557 (v2.17.6rc1)
Fixed by: https://github.com/ansible/ansible/commit/62682c30298cc18c029438d524aee3376497fd7c (v2.14.18rc1)

Search for package or bug name: Reporting problems