CVE-2024-8775: Ansible-core: exposure of sensitive information in ansible vault files due to improper logging
Description
A flaw was found in Ansible, where sensitive information stored in Ansible Vault files can be exposed in plaintext during the execution of a playbook. This occurs when using tasks such as include_vars to load vaulted variables without setting the no_log: true parameter, resulting in sensitive data being printed in the playbook output or logs. This can lead to the unintentional disclosure of secrets like passwords or API keys, compromising security and potentially allowing unauthorized access or actions.
Classification
CVE ID: CVE-2024-8775
Affected Products
Vendor: Red Hat
Product: Ansible Automation Platform Execution Environments
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.04% (probability of being exploited)
EPSS Percentile: 12.38% (scored less or equal to compared to others)
EPSS Date: 2025-02-03 (when was this score calculated)
References
https://access.redhat.com/errata/RHSA-2024:10762https://access.redhat.com/errata/RHSA-2024:8969
https://access.redhat.com/errata/RHSA-2024:9894
https://access.redhat.com/security/cve/CVE-2024-8775
https://bugzilla.redhat.com/show_bug.cgi?id=2312119