Skip to main content

Improper Encoding or Escaping of Output

CVE-2024-0690

Medium
5.5/10

Summary

An information disclosure flaw was found in ansible-core due to a failure to respect the "ANSIBLE_NO_LOG" configuration in some scenarios. It was discovered that information is still included in the output in certain tasks, such as loop items. Depending on the task, this issue may include sensitive information, such as decrypted secret values. This affects versions through 2.14.13, 2.15.0b1 through 2.15.8, and 2.16.0b1 through 2.16.2.

  • LOW
  • LOCAL
  • NONE
  • UNCHANGED
  • NONE
  • LOW
  • HIGH
  • NONE

CWE-116 - Improper Encoding or Escaping of Output

The software prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

References

Advisory Timeline

  • Published