PYSEC-2017-4: Critical severity Ansible Ansible vulnerability

Q: Which deployments are affected?

Affected releases are Ansible 2.3.x before 2.3.3 and 2.4.x before 2.4.1, where the jenkins_plugin module is used with certain parameters.

Q: What must an attacker do to exploit this issue?

The issue is remotely exploitable without privileges or user interaction. Exploitation involves causing sensitive information to be exposed in a remote host's logs through parameters passed to the jenkins_plugin module.

Q: What configuration pattern should be remediated?

Do not specify passwords in the jenkins_plugin module's "params" argument. The fix prevents passwords from being supplied through that argument and documents the restriction.

Published Nov 21, 2017

Updated

A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkinsplugin module. Remote attackers could use this flaw to expose sensitive information from a remote host's logs. This flaw was fixed by not allowing passwords to be specified in the "params" argument, and noting this in the module documentation.

Affected Software

1 affected component

Ansible Ansible<2.3.3, <2.4.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Ansible to a version that resolves this vulnerability.
Fixed in 2.3.3
Upgrade
Upgrade Ansible to a version that resolves this vulnerability.
Fixed in 2.4.1
Configuration
Do not specify passwords in the params argument.
jenkins_plugin module params = do not specify passwords

Event History

Nov 21, 2017

CVE Published

via OSV·05:29 PM

Data Sourced

via OSV·05:29 PM

DescriptionSeverity

Frequently Asked Questions

Which deployments are affected?

Affected releases are Ansible 2.3.x before 2.3.3 and 2.4.x before 2.4.1, where the jenkins_plugin module is used with certain parameters.

What must an attacker do to exploit this issue?

The issue is remotely exploitable without privileges or user interaction. Exploitation involves causing sensitive information to be exposed in a remote host's logs through parameters passed to the jenkins_plugin module.

What configuration pattern should be remediated?

Do not specify passwords in the jenkins_plugin module's "params" argument. The fix prevents passwords from being supplied through that argument and documents the restriction.

PYSEC-2017-4: Critical severity Ansible Ansible vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What must an attacker do to exploit this issue?

What configuration pattern should be remediated?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What must an attacker do to exploit this issue?

What configuration pattern should be remediated?