The version of ansible installed on the remote host is prior to 2.9.12-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ANSIBLE2-2023-006 advisory.

  - An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where     sensitive data is exposed to content and json output. This flaw allows an attacker to access the logs or     outputs of performed tasks to read keys used in playbooks from other users within the uri module. The     highest threat from this vulnerability is to data confidentiality. (CVE-2020-14330)

  - A flaw was found in the Ansible Engine when using module_args. Tasks executed with check mode (--check-     mode) do not properly neutralize sensitive data exposed in the event data. This flaw allows unauthorized     users to read this data. The highest threat from this vulnerability is to confidentiality.
    (CVE-2020-14332)

  - A flaw was found in Ansible Engine when a file is moved using atomic_move primitive as the file mode     cannot be specified. This sets the destination files world-readable if the destination file does not exist     and if the file exists, the file could be changed to have less restrictive permissions before the move.
    This could lead to the disclosure of sensitive data. All versions in 2.7.x, 2.8.x and 2.9.x branches are     believed to be vulnerable. (CVE-2020-1736)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Amazon Linux 2 : ansible (ALASANSIBLE2-2023-006)

medium Nessus Plugin ID 181970

Version 1.1

Version 1.0

Version 1.1 Sep 28, 2023, 4:12 PM Exploit attributes ("Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Plugin Feed: 202309281612
Version 1.0 Sep 27, 2023, 10:33 PM New Plugin Feed: 202309272233