TI-2017-05191 Aliases CVE-2017-7550 GHSA-588w-w6mv-3cw5

Sensitive information in log files in Red Hat ansible

MEDIUM 48CWE-532Published 2017-11-21 · Updated 2024-08-05

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · High · High
Fix status: Partial Red Hat: 1 fixed, 6 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-532.

Summary

A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkins_plugin module. Remote attackers could use this flaw to expose sensitive information from a remote host's logs. This flaw was fixed by not allowing passwords to be specified in the "params" argument, and noting this in the module documentation.

Why it matters now

EPSS 0.0353 89th percentileScored 2026-11-07

Fix Partial ansible (PyPI): 2.4.1.0, 2.3.3.0Red Hat: 1 advisoryRed Hat: 1 fixed, 6 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Red Hat	ansible	2.3.x before 2.3.3, 2.4.x before 2.4.1	—	No fix listed	CNA
—	ansible (PyPI)	2.4.0.0 to before 2.4.1.0	2.4.1.0	Patch available	GHSA-588w-w6mv-3cw5
—	ansible (PyPI)	2.3.0.0 to before 2.3.3.0	2.3.3.0	Patch available	GHSA-588w-w6mv-3cw5

ansible VendorRed Hat Affected 2.3.x before 2.3.3, 2.4.x before 2.4.1 Fixed in — No fix listed CNA
ansible (PyPI) Vendor— Affected 2.4.0.0 to before 2.4.1.0 Fixed in 2.4.1.0 Patch available GHSA-588w-w6mv-3cw5
ansible (PyPI) Vendor— Affected 2.3.0.0 to before 2.3.3.0 Fixed in 2.3.3.0 Patch available GHSA-588w-w6mv-3cw5

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:redhat:ansible::::::::	2.3.0 to before 2.3.3; 2.4.0 to before 2.4.1	Vulnerable	Red Hat
cpe:2.3:o:redhat:enterprise_linux_server:7.0:::::::*	7.0	Vulnerable	Red Hat

cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:* Versions 2.3.0 to before 2.3.3; 2.4.0 to before 2.4.1 Vulnerable ·Red Hat
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat

Remediation

Fix · GHSA-588w-w6mv-3cw5 ansible (PyPI) Fixed in 2.4.1.0 Advisory →
Fix · GHSA-588w-w6mv-3cw5 ansible (PyPI) Fixed in 2.3.3.0 Advisory →

Red Hat 1 advisory

RHSA-2017:2966 Released 2017-10-19 · Red Hat rating Moderate
ansible security, bug fix, and enhancement update
- Red Hat Enterprise Linux 7 Extras ansible-2.4.0.0-5.el7, ansible-doc-2.4.0.0-5.el7

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat OpenStack Platform 10 (Newton)	Affected	No fix planned: Will not fix
Red Hat OpenStack Platform 11 (Ocata)	Affected	No fix planned: Will not fix
Red Hat OpenStack Platform 12 (Pike)	Affected	No fix planned: Will not fix
Red Hat Quickstart Cloud Installer 1	Affected	—
Red Hat Storage 3	Affected	No fix planned: Will not fix
Red Hat Storage Console 2	Affected	No fix planned: Will not fix
Red Hat Enterprise Linux 7 Extras	Fixed	RHSA-2017:2966

Not affected: 1 product

Red Hat OpenShift Enterprise 3

Timeline

2026-10-02 Threatist record created from CVE-2017-7550
2026-10-03 Alias added: GHSA-588w-w6mv-3cw5

References

Advisory 4

Other 4

TI-2016-07808 Improper input validation in Ansible CVSS 3.1HIGH 8.1
TI-2014-03853 Injection in Ansible CVSS 3.1CRITICAL 9.8
TI-2014-03839 The safe_eval function in Ansible before 1.5.4 does not properly restrict the code… CVSS 3.1CRITICAL 9.8
TI-2014-04077 Multiple argument injection vulnerabilities in Ansible before 1.6.7 allow remote… CVSS 3.1CRITICAL 9.8
TI-2014-04076 Ansible before 1.6.7 does not prevent inventory data with "{{" and "lookup" substrings… CVSS 3.1CRITICAL 9.8
TI-2016-07090 Command injection in Red Hat Ansible CVSS 3.0CRITICAL 9.1

See all 44 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences