CVE Vulnerabilities

CVE-2017-7550

Insertion of Sensitive Information into Log File

Published: Nov 21, 2017 | Modified: Apr 20, 2025
CVSS 3.x
9.8
CRITICAL
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
5 MEDIUM
AV:N/AC:L/Au:N/C:P/I:N/A:N
RedHat/V2
RedHat/V3
8.5 MODERATE
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Ubuntu
NEGLIGIBLE

A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkins_plugin module. Remote attackers could use this flaw to expose sensitive information from a remote hosts logs. This flaw was fixed by not allowing passwords to be specified in the params argument, and noting this in the module documentation.

Weakness

The product writes sensitive information to a log file.

Affected Software

Name Vendor Start Version End Version
Ansible Redhat 2.3.0 (including) 2.3.3 (excluding)
Ansible Redhat 2.4.0 (including) 2.4.1 (excluding)
Red Hat Enterprise Linux 7 Extras RedHat ansible-0:2.4.0.0-5.el7 *
Ansible Ubuntu artful *
Ansible Ubuntu upstream *
Ansible Ubuntu zesty *

Potential Mitigations

References