CVE-2017-7550: Critical severity redhat ansible vulnerability
A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkinsplugin module. Remote attackers could use this flaw to expose sensitive information from a remote host's logs. This flaw was fixed by not allowing passwords to be specified in the "params" argument, and noting this in the module documentation.
Other sources
It was discovered that jenkinsplugin module in Ansible exposes passwords with the params attribute in the system logs of the remote host. Low privileged user on remote host can access the logs and is able to log into Jenkins instance as administrator.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-7550?
CVE-2017-7550 has been assessed with a medium severity level due to the potential exposure of sensitive information.
How do I fix CVE-2017-7550?
To resolve CVE-2017-7550, upgrade Ansible to version 2.3.3 or 2.4.1 or later.
Which versions of Ansible are affected by CVE-2017-7550?
CVE-2017-7550 affects Ansible versions 2.3.x before 2.3.3 and 2.4.x before 2.4.1.
What kind of information can be exposed due to CVE-2017-7550?
CVE-2017-7550 could allow remote attackers to access sensitive information from a remote host's logs.
Was CVE-2017-7550 found in specific distributions?
The vulnerability was identified in Ansible, particularly in versions distributed by Red Hat for Enterprise Linux.