GHSA-j2h6-73x8-22c4

Exposure of Sensitive Information to an Unauthorized Actor in ansible

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-1746

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	ansible	>= 2.8.0a1, < 2.8.11	2.8.11
PyPI	ansible	>= 2.9.0a1, < 2.9.7	2.9.7
PyPI	ansible	>= 2.7.0a1, < 2.7.17	2.7.17

Details

As written in the advisory (Markdown source, shown as plain text).

A flaw was found in the Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when the ldap_attr and ldap_entry community modules are used. The issue discloses the LDAP bind password to stdout or a log file if a playbook task is written using the `bind_pw` in the parameters field. The highest threat from this vulnerability is data confidentiality.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-1746 advisory
https://github.com/ansible/ansible/pull/67866 web
https://github.com/ansible/ansible/commit/d41e38435b1a9e300d8011ac28f16a5add2db119 web
https://github.com/ansible/ansible/commit/e6199d768c1c18a4e750ec78d4ded088629baa3f web
https://github.com/ansible/ansible/commit/edd1e1723cc937ec9251adf38c1199a00b0bf6d4 web
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1746 web
https://github.com/advisories/GHSA-j2h6-73x8-22c4 advisory
https://github.com/ansible/ansible package
https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2020-13.yaml web
https://www.debian.org/security/2021/dsa-4950 web