A flaw was found in Ansible, where sensitive information stored in Ansible Vault files can be exposed in plaintext during the execution of a playbook. This occurs when using tasks such as include_vars to load vaulted variables without setting the no_log: true parameter, resulting in sensitive data being printed in the playbook output or logs. This can lead to the unintentional disclosure of secrets like passwords or API keys, compromising security and potentially allowing unauthorized access or actions.

The remote Redhat Enterprise Linux 8 / 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:9894 advisory.

    Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing     IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to     individual teams, while automation developers retain the freedom to write tasks that leverage existing     knowledge without the overhead. Ansible Automation Platform makes it possible for users across an     organization to share, vet, and manage automation content by means of a simple, powerful, and agentless     language.

    Security Fix(es):

    * ansible-core: Exposure of Sensitive Information in Ansible Vault Files Due to Improper Logging     (CVE-2024-8775)
    * ansible-core: ansible-core user may read/write unauthorized content (CVE-2024-9902)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Updates and fixes included:

    Automation Platform UI
    * Fix filtering out hosts on inventory group (AAP-34752)
    * automation-gateway has been updated to 2.5.3-2

    Container-based Ansible Automation Platform
    * Fix issue when port value isn't defined in the gateway_main_url variable (AAP-34716)
    * Don't add port to image URLs when using default value (AAP-34070)
    * containerized installer setup has been updated to 2.5-4

    RPM-based Ansible Automation Platform
    * Fix issue not setting up gpg agent socket properly when multiple hub nodes are configured (AAP-34067)
    * ansible-automation-platform-installer and installer setup have been updated to 2.5-5

    Additional changes:
    * ansible-core has been updated to 2.16.13
    * molecule has been updated to 24.9.0-2

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3963 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3963-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Bastien Roucaris     November 23, 2024                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : ansible     Version        : 2.10.7+merged+base+2.10.17+dfsg-0+deb11u2     CVE ID         : CVE-2024-8775 CVE-2024-9902     Debian Bug     : 1082851

    Ansible is a command-line IT automation software application.
    It can configure systems, deploy software, and orchestrate     advanced workflows to support application deployment, system updates, ...

    Ansible was affected by two vulnerabilities:

    CVE-2024-8775

        A flaw was found in Ansible, where sensitive information stored in         Ansible Vault files can be exposed in plaintext during the execution         of a playbook. This occurs when using tasks such as include_vars to         load vaulted variables without setting the no_log: true parameter,         resulting in sensitive data being printed in the playbook output or         logs. This can lead to the unintentional disclosure of secrets like         passwords or API keys, compromising security and potentially         allowing unauthorized access or actions.

    CVE-2024-9902

        The ansible-core `user` module can allow an unprivileged user to         silently create or replace the contents of any file on any system path         and take ownership of it when a privileged user executes         the `user` module against the unprivileged user's home directory.
        If the unprivileged user has traversal permissions on the directory         containing the exploited target file, they retain full control         over the contents of the file as its owner.

    For Debian 11 bullseye, these problems have been fixed in version     2.10.7+merged+base+2.10.17+dfsg-0+deb11u2.

    We recommend that you upgrade your ansible packages.

    For the detailed security status of ansible please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/ansible

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
211764	RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.5 Product Release Update (Moderate) (RHSA-2024:9894)	Nessus	Red Hat Local Security Checks	medium
211754	Debian dla-3963 : ansible - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2024-8775

medium

Tenable Plugins

medium

medium