p PatchFirst

CVE-2017-7550

CVE-2017-7550

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkins_plugin module. Remote attackers could use this flaw to expose sensitive information from a remote host's logs. This flaw was fixed by not allowing passwords to be specified in the "params" argument, and noting this in the module documentation.

CVSS 9.8 · Critical · EPSS 3.6% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • ansible

    Versions
    • 2.3.x before 2.3.3, 2.4.x before 2.4.1: Affected

    No fix published

  • ansible Debian:12

    Affected ranges
    • ECOSYSTEM: < 2.4.2.0+dfsg-1

    Update to 2.4.2.0+dfsg-1

  • ansible Debian:13

    Affected ranges
    • ECOSYSTEM: < 2.4.2.0+dfsg-1

    Update to 2.4.2.0+dfsg-1

  • ansible Debian:14

    Affected ranges
    • ECOSYSTEM: < 2.4.2.0+dfsg-1

    Update to 2.4.2.0+dfsg-1

  • ansible PyPI

    Versions
    • 2.4.0.0
    Affected ranges
    • ECOSYSTEM: ≥ 2.4.0.0, < 2.4.1.0

    Update to 2.4.1.0

  • ansible PyPI

    Versions
    • 2.3.0.0
    • 2.3.1.0
    • 2.3.2.0
    Affected ranges
    • ECOSYSTEM: ≥ 2.3.0.0, < 2.3.3.0

    Update to 2.3.3.0

  • ansible PyPI

    Versions
    • 2.3.0.0
    • 2.3.1.0
    • 2.3.2.0
    • 2.4.0.0
    Affected ranges
    • ECOSYSTEM: ≥ 2.3.0.0, < 2.3.3.0 ∪ ≥ 2.4.0.0, < 2.4.1.0

    Update to 2.3.3.0; Update to 2.4.1.0

Original sources

Check your server →