PYSEC-2020-160: Medium severity Ansible Ansible vulnerability

Q: Which deployments are exposed to this issue?

Deployments using the Sumologic or Splunk callback plugins to send task-result events to collectors are affected when tasks rely on no_log=True to suppress sensitive output.

Q: Which versions contain the fix?

Upgrade to Ansible 2.9.1 or later in the 2.9 series, 2.8.7 or later in the 2.8 series, or 2.7.15 or later in the 2.7 series.

Q: How can I determine whether sensitive data may already have been disclosed?

Review whether the Sumologic or Splunk callback plugins were configured and whether task results from no_log=True tasks were sent to their collectors. Any sensitive values present in those task results may have been collected.

Published Jan 2, 2020

Updated

Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag nolog set it to True when Sumologic and Splunk callback plugins are used send tasks results events to collectors. This would discloses and collects any sensitive data.

Affected Software

1 affected component

Ansible Ansible<2.9.1, <2.8.7, <2.7.15

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Ansible to a version that resolves this vulnerability.
Fixed in 2.9.1
Upgrade
Upgrade Ansible to a version that resolves this vulnerability.
Fixed in 2.8.7
Upgrade
Upgrade Ansible to a version that resolves this vulnerability.
Fixed in 2.7.15
Configuration
Set no_log to True for tasks whose results may contain sensitive data when using the Sumologic or Splunk callback plugins.
Ansible no_log = True

Event History

Jan 2, 2020

CVE Published

via OSV·03:15 PM

Data Sourced

via OSV·03:15 PM

DescriptionSeverity

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using the Sumologic or Splunk callback plugins to send task-result events to collectors are affected when tasks rely on no_log=True to suppress sensitive output.

Which versions contain the fix?

Upgrade to Ansible 2.9.1 or later in the 2.9 series, 2.8.7 or later in the 2.8 series, or 2.7.15 or later in the 2.7 series.

How can I determine whether sensitive data may already have been disclosed?

Review whether the Sumologic or Splunk callback plugins were configured and whether task results from no_log=True tasks were sent to their collectors. Any sensitive values present in those task results may have been collected.

PYSEC-2020-160: Medium severity Ansible Ansible vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

Which versions contain the fix?

How can I determine whether sensitive data may already have been disclosed?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

Which versions contain the fix?

How can I determine whether sensitive data may already have been disclosed?