PYSEC-2019-3: Medium severity Ansible Ansible vulnerability

Q: Who is exposed to this issue?

Users running Ansible versions from 2.8.0 through before 2.8.4 who use GCP modules are exposed when those modules handle sensitive data through service_account_contents().

Q: What does an attacker need to exploit this?

The issue requires low privileges and no user interaction. The practical impact is disclosure of sensitive data in Ansible playbook output when affected GCP module fields are processed.

Q: Are all Ansible playbooks affected by default?

The available information identifies GCP modules and the shared service_account_contents() function as affected. It does not establish that playbooks not using those components are affected.

Q: How can I determine whether sensitive data may already have leaked?

Review output from Ansible playbook runs using GCP modules on affected versions, particularly where service account content or other sensitive fields were managed. The flaw can cause such data to appear in output because no_log was not set to True.

Q: What is the remediation?

Upgrade to Ansible 2.8.4 or later. The affected range is 2.8.0 before 2.8.4.

Published Nov 25, 2019

Updated

A flaw was found in ansible 2.8.0 before 2.8.4. Fields managing sensitive data should be set as such by nolog feature. Some of these fields in GCP modules are not set properly. serviceaccountcontents() which is common class for all gcp modules is not setting nolog to True. Any sensitive data managed by that function would be leak as an output when running ansible playbooks.

Affected Software

1 affected component

Ansible Ansible>=2.8.0<2.8.4

Event History

Nov 25, 2019

CVE Published

via OSV·04:15 PM

Data Sourced

via OSV·04:15 PM

DescriptionSeverity

Frequently Asked Questions

Who is exposed to this issue?

Users running Ansible versions from 2.8.0 through before 2.8.4 who use GCP modules are exposed when those modules handle sensitive data through service_account_contents().

What does an attacker need to exploit this?

The issue requires low privileges and no user interaction. The practical impact is disclosure of sensitive data in Ansible playbook output when affected GCP module fields are processed.

Are all Ansible playbooks affected by default?

The available information identifies GCP modules and the shared service_account_contents() function as affected. It does not establish that playbooks not using those components are affected.

How can I determine whether sensitive data may already have leaked?

Review output from Ansible playbook runs using GCP modules on affected versions, particularly where service account content or other sensitive fields were managed. The flaw can cause such data to appear in output because no_log was not set to True.

What is the remediation?

Upgrade to Ansible 2.8.4 or later. The affected range is 2.8.0 before 2.8.4.

PYSEC-2019-3: Medium severity Ansible Ansible vulnerability

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit this?

Are all Ansible playbooks affected by default?

How can I determine whether sensitive data may already have leaked?

What is the remediation?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit this?

Are all Ansible playbooks affected by default?

How can I determine whether sensitive data may already have leaked?

What is the remediation?