PYSEC-2020-13: Medium severity Ansible Ansible Engine vulnerability

Q: When is the LDAP bind password exposed?

Exposure occurs when the ldap_attr or ldap_entry community module is used and a playbook task supplies bind_pw in the parameters field. The password may be written to stdout or to a log file.

Q: What access would an attacker need to exploit this issue?

The vector is local, requires low privileges, and requires user interaction. The disclosed impact is confidentiality only; integrity and availability are not affected.

Q: Which versions are affected?

Affected releases are Ansible Engine 2.7.x before 2.7.17, 2.8.x before 2.8.11, and 2.9.x before 2.9.7. Ansible Tower is affected before and including 3.4.5, 3.5.5, and 3.6.3 when the specified community modules are used.

Published May 12, 2020

Updated

A flaw was found in the Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when the ldapattr and ldapentry community modules are used. The issue discloses the LDAP bind password to stdout or a log file if a playbook task is written using the bindpw in the parameters field. The highest threat from this vulnerability is data confidentiality.

Affected Software

2 affected components

Ansible Ansible Engine<2.7.17, <2.8.11, <2.9.7

Ansible Ansible Tower<=3.4.5, <=3.5.5, <=3.6.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Ansible Engine to a version that resolves this vulnerability.
Fixed in 2.7.17
Upgrade
Upgrade Ansible Engine to a version that resolves this vulnerability.
Fixed in 2.8.11
Upgrade
Upgrade Ansible Engine to a version that resolves this vulnerability.
Fixed in 2.9.7

Event History

May 12, 2020

CVE Published

via OSV·06:15 PM

Data Sourced

via OSV·06:15 PM

DescriptionSeverity

Frequently Asked Questions

When is the LDAP bind password exposed?

Exposure occurs when the ldap_attr or ldap_entry community module is used and a playbook task supplies bind_pw in the parameters field. The password may be written to stdout or to a log file.

What access would an attacker need to exploit this issue?

The vector is local, requires low privileges, and requires user interaction. The disclosed impact is confidentiality only; integrity and availability are not affected.

Which versions are affected?

Affected releases are Ansible Engine 2.7.x before 2.7.17, 2.8.x before 2.8.11, and 2.9.x before 2.9.7. Ansible Tower is affected before and including 3.4.5, 3.5.5, and 3.6.3 when the specified community modules are used.

PYSEC-2020-13: Medium severity Ansible Ansible Engine vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

When is the LDAP bind password exposed?

What access would an attacker need to exploit this issue?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

When is the LDAP bind password exposed?

What access would an attacker need to exploit this issue?

Which versions are affected?