A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkins_plugin module. Remote attackers could use this flaw to expose sensitive information from a remote hosts logs. This flaw was fixed by not allowing passwords to be specified in the params argument, and noting this in the module documentation.
Weakness
The product writes sensitive information to a log file.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Ansible | Redhat | 2.3.0 (including) | 2.3.3 (excluding) |
| Ansible | Redhat | 2.4.0 (including) | 2.4.1 (excluding) |
| Red Hat Enterprise Linux 7 Extras | RedHat | ansible-0:2.4.0.0-5.el7 | * |
| Ansible | Ubuntu | artful | * |
| Ansible | Ubuntu | upstream | * |
| Ansible | Ubuntu | zesty | * |