CVE-2017-7550 Ansible Insertion of Sensitive Information into Log File vulnerability

What is CVE-2017-7550?

CVE-2017-7550 is a critical vulnerability in Redhat Enterprise Linux Server, published on 21 Nov 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkins_plugin module. Remote attackers could use this flaw to expose sensitive information from a remote host's logs. This flaw was fixed by not allowing passwords to be specified in the "params" argument, and noting this in the module documentation.

Weakness: CWE-532

Which versions are affected by CVE-2017-7550?

5 open source packages ship an affected version, including ansible. It affects 2 products.

Products include Redhat Ansible, Redhat Enterprise Linux Server.

How do I fix CVE-2017-7550?

Upgrade ansible to a fixed version for your release line: 2.3.3.0 or 2.4.1.0.

Is CVE-2017-7550 being exploited?

There is no known exploitation of CVE-2017-7550 in the wild and no public exploit code.

Other vulnerabilities in Redhat Enterprise Linux Server

• CVE-2014-4657 Ansible Remote Code Execution Critical 9.8
• CVE-2014-4966 Ansible Arbitrary Code Execution Critical 9.8
• CVE-2014-4967 Ansible Arbitrary Code Execution Critical 9.8
• CVE-2014-3498 Ansible Arbitrary Code Execution High 8.8
• CVE-2017-7466 Ansible Arbitrary Code Execution High 8.0

All Redhat Enterprise Linux Server vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2017-7550, GHSA-588w-w6mv-3cw5, MGASA-2017-0399, PYSEC-2017-4, RHSA-2017:2966, SUSE-SU-2018:0605-1.