CVE-2024-8775

Medium

Description

A flaw was found in Ansible, where sensitive information stored in Ansible Vault files can be exposed in plaintext during the execution of a playbook. This occurs when using tasks such as include_vars to load vaulted variables without setting the no_log: true parameter, resulting in sensitive data being printed in the playbook output or logs. This can lead to the unintentional disclosure of secrets like passwords or API keys, compromising security and potentially allowing unauthorized access or actions.

SeverityMedium
CVSS5.5
Exploit probability—
ProductAnsible-core
PublishedSep 14, 2024
First seenSep 14, 2024
Weakness typeCWE-532CWE-532

How to fix

Affected products

ProductAffected versionsFixed in
ansible-corePyPI2.17.0b1 ≤ v < 2.17.6, v < 2.16.132.17.6, 2.16.13

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.