CVE-2017-7550

A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkins_plugin module. Remote attackers could use this flaw to expose sensitive information from a remote host's logs. This flaw was fixed by not allowing passwords to be specified in the "params" argument, and noting this in the module documentation.

Score

CVSS 3.1 9.8 Critical

Status

Modified - secalert@redhat.com

Published

2017-11-21

Last modified

2024-08-05

Weaknesses

CWE-532

Affected products

• Ansible (Red Hat Inc.)
• Ansible (Redhat)
• Enterprise Linux Server (Redhat)

References

• https://access.redhat.com/errata/RHSA-2017:2966
• https://bugzilla.redhat.com/show_bug.cgi?id=1473645
• https://github.com/ansible/ansible/issues/30874