A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkins_plugin module. Remote attackers could use this flaw to expose sensitive information from a remote hosts logs. This flaw was fixed by not allowing passwords to be specified in the params argument, and noting this in the module documentation.
Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Ansible | Redhat | 2.3.0 (including) | 2.3.3 (excluding) |
| Ansible | Redhat | 2.4.0 (including) | 2.4.1 (excluding) |
| Red Hat Enterprise Linux 7 Extras | RedHat | ansible-0:2.4.0.0-5.el7 | * |
| Ansible | Ubuntu | artful | * |
| Ansible | Ubuntu | upstream | * |
| Ansible | Ubuntu | zesty | * |
While logging all information may be helpful during development stages, it is important that logging levels be set appropriately before a product ships so that sensitive user data and system information are not accidentally exposed to potential attackers. Different log files may be produced and stored for: