CVE-2024-0690: Ansible-core: possible information leak in tasks that ignore ansible_no_log configuration
Vulnerability summary
CVE-2024-0690 is a medium (CVSS 5.5) Improper Output Neutralization for Logs vulnerability in fedoraproject fedora. EPSS estimates a 0.30% chance of exploitation in the next 30 days, higher than 23.2% of scored vulnerabilities.
Not severe (CVSS 5, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 8 · Related 7Timeline
- 06-02-2024PublishedVulnerability first disclosed.
- 06-11-2025Last modifiedVulnerability information updated.
Description
An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG configuration in some scenarios. Information is still included in the output in certain tasks, such as loop items. Depending on the task, this issue may include sensitive information, such as decrypted secret values.
CVSS metrics
6 scores · 6 sources · 1 version- CVE.orgCNA5.0MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:NDiffers
- OSV · PypiEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- OSV · Red hatEcosystem advisory · calculated5.0MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.30%
Chance of exploitation in the next 30 days
Percentile
23%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.30% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-117Improper Output Neutralization for LogsThe product constructs a log message from external input, but it does not neutralize or incorrectly neutralizes special elements when the message is written to a log file.
- CWE-116Improper Encoding or Escaping of OutputThe product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Affected systems
Known conditions: local access, low-privilege account, user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat7 products
- ansible< 2.14.4 | ≥ 2.15.0, < 2.15.9 | ≥ 2.16.0, < 2.16.3
- ansible_automation_platformEOL2.4
- ansible_developer1.1
- ansible_inside1.2
- enterprise_linux8.0 | 9.0
Debian2 products
- ansible< 5.4.0-1
- ansible-core< 2.14.16-0+deb12u1 | < 2.16.5-1
Ubuntu2 products
- ansibleAll versions (No fix recorded)
- ansible-coreAll versions (No fix recorded)
Fedoraproject1 product
- fedoraEOL38 | 39
Mageia1 product
- python-ansible-core< 2.14.17-1.1.mga9
PyPI1 product
- ansible-core< 2.14.14 | ≥ 2.15.0, < 2.15.9 | ≥ 2.16.0, < 2.16.3
6 vendors · 14 products
References
38 links- access.redhat.com/security/cve/CVE-2024-0690VDB EntryX Refsource REDHATWEBAdvisoryREPORTVendor Advisory
Show all 38 references
- github.com/ansible/ansiblePACKAGE
