CVE-2020-25646 Information disclosure in Community Collections
Attackers can read private keys from logs due to improper output handling in the Ansible community.crypto collection.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-25646?
CVE-2020-25646 is a high-severity vulnerability in Ansible Community Community Collections, published on 29 Oct 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in Ansible Collection community.crypto. openssl_privatekey_info exposes private key in logs. This directly impacts confidentiality
Which versions are affected by CVE-2020-25646?
It affects 1 product.
Products include Ansible Collections Project Community.crypto.
How do I fix CVE-2020-25646?
Upgrade to a fixed version.
Is CVE-2020-25646 being exploited?
There is no known exploitation of CVE-2020-25646 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2020-25646, CLEANSTART-2026-WL91519, GHSA-92hf-4chr-8hrf, UBUNTU-CVE-2020-25646.