CVE-2024-8775

NameCVE-2024-8775
DescriptionA flaw was found in Ansible, where sensitive information stored in Ansible Vault files can be exposed in plaintext during the execution of a playbook. This occurs when using tasks such as include_vars to load vaulted variables without setting the no_log: true parameter, resulting in sensitive data being printed in the playbook output or logs. This can lead to the unintentional disclosure of secrets like passwords or API keys, compromising security and potentially allowing unauthorized access or actions.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1082851

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
ansible (PTS)jessie, jessie (lts)1.7.2+dfsg-2+deb8u3vulnerable
stretch (security), stretch (lts), stretch2.2.1.0-2+deb9u3vulnerable
buster (security), buster, buster (lts)2.7.7+dfsg-1+deb10u2vulnerable
bullseye2.10.7+merged+base+2.10.17+dfsg-0+deb11u1vulnerable
bookworm7.7.0+dfsg-3+deb12u1fixed
sid, trixie10.5.0+dfsg-2fixed
ansible-core (PTS)bookworm2.14.16-0+deb12u1vulnerable
sid, trixie2.17.5-4vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
ansiblesourcestretch(unfixed)end-of-life
ansiblesource(unstable)5.4.0-1
ansible-coresource(unstable)(unfixed)1082851

Notes

[bookworm] - ansible-core <no-dsa> (Minor issue)
ansible-core was split off from src:ansible with 4.6.0-1 in experimental/5.4.0-1 in sid
https://bugzilla.redhat.com/show_bug.cgi?id=2312119
Ansible bug: https://github.com/ansible/ansible/pull/84179
Fixed by: https://github.com/ansible/ansible/commit/23f8639a4b01f6437f241d835efb68b8b7150575 (v2.18.0rc2)
Fixed by: https://github.com/ansible/ansible/commit/4a654435470c88a5732af5d647d0014b2eea2557 (v2.17.6rc1)
Fixed by: https://github.com/ansible/ansible/commit/62682c30298cc18c029438d524aee3376497fd7c (v2.14.18rc1)

Search for package or bug name: Reporting problems