SB2020090424 - Fedora EPEL 8 update for ansible

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2020090424

SB2020090424 - Fedora EPEL 8 update for ansible

Published: September 4, 2020 Updated: April 25, 2025

Security Bulletin ID SB2020090424
Severity
Low
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Local access
Highest impact Information disclosure

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Input validation error (CVE-ID: CVE-2020-14330)

The vulnerability allows a local authenticated user to gain access to sensitive information.

An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content and json output. This flaw allows an attacker to access the logs or outputs of performed tasks to read keys used in playbooks from other users within the uri module. The highest threat from this vulnerability is to data confidentiality.


2) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2020-14332)

The vulnerability allows a local authenticated user to gain access to sensitive information.

A flaw was found in the Ansible Engine when using module_args. Tasks executed with check mode (--check-mode) do not properly neutralize sensitive data exposed in the event data. This flaw allows unauthorized users to read this data. The highest threat from this vulnerability is to confidentiality.


Remediation

Install update from vendor's website.

References