CVE-2020-1753
A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prior to 2.8.11 and all Ansible 2.9.x versions prior to 2.9.7, when managing kubernetes using the k8s module. Sensitive parameters such as passwords and tokens are passed to kubectl from the command line, not using an environment variable or an input configuration file. This will disclose passwords and tokens from process list and no_log directive from debug module would not have any effect making these secrets being disclosed on stdout and log files.
Published:Mar 9, 2020
Last Modified:Nov 21, 2024
EPS:Mar 16, 2020
EPSS Score:0.00039
CVSS Score:5
Affected Products
Vendor
Product
Action
Vendor
Debian
Product
Debian Linux
Debian
Debian Linux
Vendor
Fedoraproject
Product
Fedora
Fedoraproject
Fedora
Vendor
Redhat
Product
Ansible Engine
Redhat
Ansible Engine
Vendor
Redhat
Product
Ansible Tower
Redhat
Ansible Tower
Exploits
Common Weakness Enumeration
Common Attack Pattern Enumeration and Classification (CAPEC)
Related CVEs
References
Common Vulnerability Scoring System
Attack Vector
Network
Adjacent
Local
Physical
Privileges Required
None
Low
High
User Interaction
None
Required
Scope
Unchanged
Changed
Confidentiality
None
Low
High
Integrity
None
Low
High
Availability
None
Low
High
