{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35150?format=json","vulnerability_id":"VCID-pm6p-9arz-7ygs","summary":"A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkins_plugin module. Remote attackers could use this flaw to expose sensitive information from a remote host's logs. This flaw was fixed by not allowing passwords to be specified in the \"params\" argument, and noting this in the module documentation.","aliases":[{"alias":"CVE-2017-7550"},{"alias":"PYSEC-2017-4"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/10569?format=json","purl":"pkg:pypi/ansible@2.3.3.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1sty-hqbq-63hy"},{"vulnerability":"VCID-2z4k-r21v-rfgx"},{"vulnerability":"VCID-7qnx-1gp2-v7bb"},{"vulnerability":"VCID-833d-up6b-rfe1"},{"vulnerability":"VCID-8u2v-jtqe-dqg3"},{"vulnerability":"VCID-am9g-ba4h-sfhr"},{"vulnerability":"VCID-cuq1-se5h-vygd"},{"vulnerability":"VCID-cxts-25nq-4fcs"},{"vulnerability":"VCID-dkds-s3ad-cufa"},{"vulnerability":"VCID-gm99-68bj-c3cz"},{"vulnerability":"VCID-gxw4-ydnj-fkfe"},{"vulnerability":"VCID-hjc4-jcfm-7be5"},{"vulnerability":"VCID-hpqa-ysnc-b7dw"},{"vulnerability":"VCID-hq4d-92s2-vqg6"},{"vulnerability":"VCID-k8a2-5yfh-j7gp"},{"vulnerability":"VCID-mbj9-3bnb-wbda"},{"vulnerability":"VCID-p4p5-29r5-8qh9"},{"vulnerability":"VCID-pqj1-u787-g3aj"},{"vulnerability":"VCID-subj-aje2-93bk"},{"vulnerability":"VCID-utrp-hfpb-tygj"},{"vulnerability":"VCID-vhxq-1hqq-77bx"},{"vulnerability":"VCID-vsv2-4d8c-m3g1"},{"vulnerability":"VCID-x4mr-vrp9-ufg6"},{"vulnerability":"VCID-ykkx-swgs-vybn"},{"vulnerability":"VCID-yre5-mmmj-q3bn"},{"vulnerability":"VCID-zwrg-9mrq-effd"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/ansible@2.3.3.0"},{"url":"http://public2.vulnerablecode.io/api/packages/10568?format=json","purl":"pkg:pypi/ansible@2.4.1.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1sty-hqbq-63hy"},{"vulnerability":"VCID-2z4k-r21v-rfgx"},{"vulnerability":"VCID-5cgu-g45y-q3cj"},{"vulnerability":"VCID-7qnx-1gp2-v7bb"},{"vulnerability":"VCID-833d-up6b-rfe1"},{"vulnerability":"VCID-8u2v-jtqe-dqg3"},{"vulnerability":"VCID-am9g-ba4h-sfhr"},{"vulnerability":"VCID-cuq1-se5h-vygd"},{"vulnerability":"VCID-cxts-25nq-4fcs"},{"vulnerability":"VCID-dkds-s3ad-cufa"},{"vulnerability":"VCID-gm99-68bj-c3cz"},{"vulnerability":"VCID-gxw4-ydnj-fkfe"},{"vulnerability":"VCID-hjc4-jcfm-7be5"},{"vulnerability":"VCID-hpqa-ysnc-b7dw"},{"vulnerability":"VCID-hq4d-92s2-vqg6"},{"vulnerability":"VCID-k8a2-5yfh-j7gp"},{"vulnerability":"VCID-mbj9-3bnb-wbda"},{"vulnerability":"VCID-p4p5-29r5-8qh9"},{"vulnerability":"VCID-pqj1-u787-g3aj"},{"vulnerability":"VCID-subj-aje2-93bk"},{"vulnerability":"VCID-vhxq-1hqq-77bx"},{"vulnerability":"VCID-vsv2-4d8c-m3g1"},{"vulnerability":"VCID-x4mr-vrp9-ufg6"},{"vulnerability":"VCID-x99c-b7ve-hkdj"},{"vulnerability":"VCID-ykkx-swgs-vybn"},{"vulnerability":"VCID-yre5-mmmj-q3bn"},{"vulnerability":"VCID-zwrg-9mrq-effd"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/ansible@2.4.1.0"}],"affected_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/54732?format=json","purl":"pkg:pypi/ansible@2.3.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-pm6p-9arz-7ygs"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/ansible@2.3.0"},{"url":"http://public2.vulnerablecode.io/api/packages/10564?format=json","purl":"pkg:pypi/ansible@2.3.0.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1sty-hqbq-63hy"},{"vulnerability":"VCID-2z4k-r21v-rfgx"},{"vulnerability":"VCID-7qnx-1gp2-v7bb"},{"vulnerability":"VCID-833d-up6b-rfe1"},{"vulnerability":"VCID-8u2v-jtqe-dqg3"},{"vulnerability":"VCID-am9g-ba4h-sfhr"},{"vulnerability":"VCID-cuq1-se5h-vygd"},{"vulnerability":"VCID-cxts-25nq-4fcs"},{"vulnerability":"VCID-dkds-s3ad-cufa"},{"vulnerability":"VCID-gm99-68bj-c3cz"},{"vulnerability":"VCID-gxw4-ydnj-fkfe"},{"vulnerability":"VCID-hjc4-jcfm-7be5"},{"vulnerability":"VCID-hpqa-ysnc-b7dw"},{"vulnerability":"VCID-hq4d-92s2-vqg6"},{"vulnerability":"VCID-k8a2-5yfh-j7gp"},{"vulnerability":"VCID-mbj9-3bnb-wbda"},{"vulnerability":"VCID-p4p5-29r5-8qh9"},{"vulnerability":"VCID-pm6p-9arz-7ygs"},{"vulnerability":"VCID-pqj1-u787-g3aj"},{"vulnerability":"VCID-subj-aje2-93bk"},{"vulnerability":"VCID-utrp-hfpb-tygj"},{"vulnerability":"VCID-vhxq-1hqq-77bx"},{"vulnerability":"VCID-vsv2-4d8c-m3g1"},{"vulnerability":"VCID-x4mr-vrp9-ufg6"},{"vulnerability":"VCID-ykkx-swgs-vybn"},{"vulnerability":"VCID-yre5-mmmj-q3bn"},{"vulnerability":"VCID-zwrg-9mrq-effd"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/ansible@2.3.0.0"},{"url":"http://public2.vulnerablecode.io/api/packages/10565?format=json","purl":"pkg:pypi/ansible@2.3.1.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1sty-hqbq-63hy"},{"vulnerability":"VCID-2z4k-r21v-rfgx"},{"vulnerability":"VCID-7qnx-1gp2-v7bb"},{"vulnerability":"VCID-833d-up6b-rfe1"},{"vulnerability":"VCID-8u2v-jtqe-dqg3"},{"vulnerability":"VCID-am9g-ba4h-sfhr"},{"vulnerability":"VCID-cuq1-se5h-vygd"},{"vulnerability":"VCID-cxts-25nq-4fcs"},{"vulnerability":"VCID-dkds-s3ad-cufa"},{"vulnerability":"VCID-gm99-68bj-c3cz"},{"vulnerability":"VCID-gxw4-ydnj-fkfe"},{"vulnerability":"VCID-hjc4-jcfm-7be5"},{"vulnerability":"VCID-hpqa-ysnc-b7dw"},{"vulnerability":"VCID-hq4d-92s2-vqg6"},{"vulnerability":"VCID-k8a2-5yfh-j7gp"},{"vulnerability":"VCID-mbj9-3bnb-wbda"},{"vulnerability":"VCID-p4p5-29r5-8qh9"},{"vulnerability":"VCID-pm6p-9arz-7ygs"},{"vulnerability":"VCID-pqj1-u787-g3aj"},{"vulnerability":"VCID-subj-aje2-93bk"},{"vulnerability":"VCID-vhxq-1hqq-77bx"},{"vulnerability":"VCID-vsv2-4d8c-m3g1"},{"vulnerability":"VCID-x4mr-vrp9-ufg6"},{"vulnerability":"VCID-ykkx-swgs-vybn"},{"vulnerability":"VCID-yre5-mmmj-q3bn"},{"vulnerability":"VCID-zwrg-9mrq-effd"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/ansible@2.3.1.0"},{"url":"http://public2.vulnerablecode.io/api/packages/10566?format=json","purl":"pkg:pypi/ansible@2.3.2.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1sty-hqbq-63hy"},{"vulnerability":"VCID-2z4k-r21v-rfgx"},{"vulnerability":"VCID-7qnx-1gp2-v7bb"},{"vulnerability":"VCID-833d-up6b-rfe1"},{"vulnerability":"VCID-8u2v-jtqe-dqg3"},{"vulnerability":"VCID-am9g-ba4h-sfhr"},{"vulnerability":"VCID-cuq1-se5h-vygd"},{"vulnerability":"VCID-cxts-25nq-4fcs"},{"vulnerability":"VCID-dkds-s3ad-cufa"},{"vulnerability":"VCID-gm99-68bj-c3cz"},{"vulnerability":"VCID-gxw4-ydnj-fkfe"},{"vulnerability":"VCID-hjc4-jcfm-7be5"},{"vulnerability":"VCID-hpqa-ysnc-b7dw"},{"vulnerability":"VCID-hq4d-92s2-vqg6"},{"vulnerability":"VCID-k8a2-5yfh-j7gp"},{"vulnerability":"VCID-mbj9-3bnb-wbda"},{"vulnerability":"VCID-p4p5-29r5-8qh9"},{"vulnerability":"VCID-pm6p-9arz-7ygs"},{"vulnerability":"VCID-pqj1-u787-g3aj"},{"vulnerability":"VCID-subj-aje2-93bk"},{"vulnerability":"VCID-utrp-hfpb-tygj"},{"vulnerability":"VCID-vhxq-1hqq-77bx"},{"vulnerability":"VCID-vsv2-4d8c-m3g1"},{"vulnerability":"VCID-x4mr-vrp9-ufg6"},{"vulnerability":"VCID-ykkx-swgs-vybn"},{"vulnerability":"VCID-yre5-mmmj-q3bn"},{"vulnerability":"VCID-zwrg-9mrq-effd"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/ansible@2.3.2.0"},{"url":"http://public2.vulnerablecode.io/api/packages/54733?format=json","purl":"pkg:pypi/ansible@2.4.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-pm6p-9arz-7ygs"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/ansible@2.4.0"},{"url":"http://public2.vulnerablecode.io/api/packages/10567?format=json","purl":"pkg:pypi/ansible@2.4.0.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1sty-hqbq-63hy"},{"vulnerability":"VCID-2z4k-r21v-rfgx"},{"vulnerability":"VCID-5cgu-g45y-q3cj"},{"vulnerability":"VCID-7qnx-1gp2-v7bb"},{"vulnerability":"VCID-833d-up6b-rfe1"},{"vulnerability":"VCID-8u2v-jtqe-dqg3"},{"vulnerability":"VCID-am9g-ba4h-sfhr"},{"vulnerability":"VCID-cuq1-se5h-vygd"},{"vulnerability":"VCID-cxts-25nq-4fcs"},{"vulnerability":"VCID-dkds-s3ad-cufa"},{"vulnerability":"VCID-gm99-68bj-c3cz"},{"vulnerability":"VCID-gxw4-ydnj-fkfe"},{"vulnerability":"VCID-hjc4-jcfm-7be5"},{"vulnerability":"VCID-hpqa-ysnc-b7dw"},{"vulnerability":"VCID-hq4d-92s2-vqg6"},{"vulnerability":"VCID-k8a2-5yfh-j7gp"},{"vulnerability":"VCID-mbj9-3bnb-wbda"},{"vulnerability":"VCID-p4p5-29r5-8qh9"},{"vulnerability":"VCID-pm6p-9arz-7ygs"},{"vulnerability":"VCID-pqj1-u787-g3aj"},{"vulnerability":"VCID-subj-aje2-93bk"},{"vulnerability":"VCID-vhxq-1hqq-77bx"},{"vulnerability":"VCID-vsv2-4d8c-m3g1"},{"vulnerability":"VCID-x4mr-vrp9-ufg6"},{"vulnerability":"VCID-x99c-b7ve-hkdj"},{"vulnerability":"VCID-ykkx-swgs-vybn"},{"vulnerability":"VCID-yre5-mmmj-q3bn"},{"vulnerability":"VCID-zwrg-9mrq-effd"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/ansible@2.4.0.0"}],"references":[{"reference_url":"https://access.redhat.com/errata/RHSA-2017:2966","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2017:2966"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1473645","reference_id":"","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1473645"},{"reference_url":"https://github.com/ansible/ansible/issues/30874","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/ansible/ansible/issues/30874"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2017-7550","reference_id":"CVE-2017-7550","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-7550"}],"weaknesses":[{"cwe_id":1035,"name":"OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities","description":"Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017."},{"cwe_id":532,"name":"Insertion of Sensitive Information into Log File","description":"Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information."},{"cwe_id":937,"name":"OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities","description":"Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013."}],"exploits":[],"severity_range_score":null,"exploitability":null,"weighted_severity":null,"risk_score":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-pm6p-9arz-7ygs"}