The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2017:2966 advisory.

    Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task     execution system. Ansible works over SSH and does not require any software or daemons to be installed on     remote nodes. Extension modules can be written in any language and are transferred to managed machines     automatically.

    The ansible packages have been upgraded to upstream version 2.4.0, which provides a number of bug fixes     and enhancements over the previous version. For more information, please see the Ansible 2.4 Porting Guide     linked in the References section. (BZ#1492477)

    Security Fix(es):

    * A flaw was found in the way Ansible passed certain parameters to the jenkins_plugin module. A remote     attacker could use this flaw to expose sensitive information from a remote host's logs. This flaw was     fixed by not allowing passwords to be specified in the params argument, and noting this in the module     documentation. (CVE-2017-7550)

    Red Hat would like to thank Stefano Mazzucco (Kirontech) for reporting this issue.

    Bug Fix(es):

    * A bug in the SELinux module, which caused a corruption of the SELinux configuration file, has been     fixed.

    * Previously, some of the functionality of Ansible (the json_query filter) was unavailable, because the     dependency on the python2-jmespath package was missing. Now, the missing dependency has been added.
    (BZ#1484910)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 7 : ansible (RHSA-2017:2966)

critical Nessus Plugin ID 104005

Version 3.11

Version 3.10

Version 3.11 Nov 5, 2024, 12:50 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Plugin metadata Plugin Feed: 202411051250
Version 3.10 Apr 28, 2024, 3:17 AM CVSSv2 score source (set to "CVE-2017-7550") Detection (updated detection logic) Plugin metadata Reference Plugin Feed: 202404280317