Search for packages
| purl | pkg:pypi/ansible-core@2.11.2rc1 |
| Next non-vulnerable version | 2.16.14rc1 |
| Latest non-vulnerable version | 2.18.1rc1 |
| Risk | 4.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-1wv8-rvwu-nye3
Aliases: CVE-2024-9902 GHSA-32p4-gm2c-wmch |
ansible-core Incorrect Authorization vulnerability A flaw was found in Ansible. The ansible-core `user` module can allow an unprivileged user to silently create or replace the contents of any file on any system path and take ownership of it when a privileged user executes the `user` module against the unprivileged user's home directory. If the unprivileged user has traversal permissions on the directory containing the exploited target file, they retain full control over the contents of the file as its owner. |
Affected by 1 other vulnerability. Affected by 1 other vulnerability. Affected by 1 other vulnerability. Affected by 1 other vulnerability. Affected by 1 other vulnerability. |
|
VCID-4pht-n5pc-f3gw
Aliases: CVE-2024-8775 GHSA-jpxc-vmjf-9fcj |
Ansible vulnerable to Insertion of Sensitive Information into Log File A flaw was found in Ansible, where sensitive information stored in Ansible Vault files can be exposed in plaintext during the execution of a playbook. This occurs when using tasks such as include_vars to load vaulted variables without setting the no_log: true parameter, resulting in sensitive data being printed in the playbook output or logs. This can lead to the unintentional disclosure of secrets like passwords or API keys, compromising security and potentially allowing unauthorized access or actions. |
Affected by 1 other vulnerability. Affected by 3 other vulnerabilities. Affected by 1 other vulnerability. |
|
VCID-682j-e2pu-1uee
Aliases: CVE-2023-5764 GHSA-7j69-qfc3-2fq9 |
Improper Neutralization of Special Elements Used in a Template Engine A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data. This issue could allow an attacker to use a specially crafted file to introduce code injection when supplying templating data. |
Affected by 4 other vulnerabilities. Affected by 4 other vulnerabilities. Affected by 4 other vulnerabilities. |
|
VCID-g2pj-dmae-e3er
Aliases: CVE-2024-0690 GHSA-h24r-m9qc-pvpg PYSEC-2024-36 |
An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG configuration in some scenarios. It was discovered that information is still included in the output in certain tasks, such as loop items. Depending on the task, this issue may include sensitive information, such as decrypted secret values. |
Affected by 6 other vulnerabilities. Affected by 3 other vulnerabilities. Affected by 3 other vulnerabilities. Affected by 3 other vulnerabilities. |
|
VCID-v6rk-y6ws-dkh9
Aliases: CVE-2024-11079 GHSA-99w6-3xph-cx78 |
Ansible-Core vulnerable to content protections bypass A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content. This issue can lead to arbitrary code execution if remote data or module outputs are improperly templated within playbooks. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-w8qm-73f3-rkbm
Aliases: CVE-2023-4237 GHSA-ww3m-ffrm-qvqv |
Ansible may expose private key A flaw was found in the Ansible Automation Platform. When creating a new keypair, the ec2_key module prints out the private key directly to the standard output. This flaw allows an attacker to fetch those keys from the log files, compromising the system's confidentiality, integrity, and availability. |
Affected by 5 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||