Ansible

ansible before versions 2.8.6, 2.7.14, 2.6.20 is vulnerable to a None

Published: 2019-11-26T13:01:31.000Z
Updated: 2024-08-05T00:26:39.119Z

Ansible "User" module leaks any data which is passed on as a parameter to ssh-keygen. This could lean in undesirable situations such as passphrases credentials passed as a parameter for the ssh-keygen executable. Showing those credentials in clear text form for every user which have access just to the process list.

Published: 2018-10-23T15:00:00.000Z
Updated: 2024-08-05T10:32:54.010Z

A flaw was found in ansible. ansible.cfg is read from the current working directory which can be altered to make it point to a plugin or a module path under the control of an attacker, thus allowing the attacker to execute arbitrary code.

Published: 2018-07-13T22:00:00.000Z
Updated: 2024-08-05T07:46:47.518Z

In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.

Published: 2018-07-02T13:00:00.000Z
Updated: 2024-08-05T07:46:47.224Z

Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on the terminal of the user running Ansible.

Published: 2018-07-02T18:00:00.000Z
Updated: 2024-08-05T07:46:47.397Z