CVE-2024-8775
mediumPriorität · verfolgen · 0EPSS 0.003 · 19. PerzentilDEEURUUSEPSS · bewertet 2026-10-27
A flaw was found in Ansible, where sensitive information stored in Ansible Vault files can be exposed in plaintext during the execution of a playbook. This occurs when using tasks such as include_vars to load vaulted variables without setting the no_log: true parameter, resulting in sensitive data being printed in the playbook output or logs. This can lead to the unintentional disclosure of secrets like passwords or API keys, compromising security and potentially allowing unauthorized access or actions.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (42)
Betroffene Produkte und Versionsbereiche.
- Red Hat Ansible Automation Platform 2alle Versionencert_bundDEcpe:/a:redhat:ansible_automation_platform:2
- Red Hat Ansible Automation Platform 2.5alle Versionencert_bundDEcpe:/a:redhat:ansible_automation_platform:2.5
Advisories (3)
Hersteller- und Ökosystem-Meldungen dazu.
- WID-SEC-W-2024-2151Ansible: Schwachstelle ermöglicht Offenlegung von InformationenDeutsch2024-09-16csaf · cert_bundDE
Ein lokaler Angreifer kann eine Schwachstelle in Ansible und Red Hat Ansible Automation Platform ausnutzen, um Informationen offenzulegen.
- GHSA-jpxc-vmjf-9fcjAnsible vulnerable to Insertion of Sensitive Information into Log File2024-09-16ghsa · osvUS
A flaw was found in Ansible, where sensitive information stored in Ansible Vault files can be exposed in plaintext during the execution of a playbook. This occurs when using tasks such as include_vars to load vaulted variables without setting the no_log: true parameter, resulting in sensitive data being printed in the playbook output or logs. This can lead to the unintentional disclosure of secrets like passwords or API keys, compromising security and potentially allowing unauthorized access or actions.
- PYSEC-2026-1124Ansible vulnerable to Insertion of Sensitive Information into Log File2026-07-07vendor · osvUS
A flaw was found in Ansible, where sensitive information stored in Ansible Vault files can be exposed in plaintext during the execution of a playbook. This occurs when using tasks such as include_vars to load vaulted variables without setting the no_log: true parameter, resulting in sensitive data being printed in the playbook output or logs. This can lead to the unintentional disclosure of secrets like passwords or API keys, compromising security and potentially allowing unauthorized access or actions.
auch bekannt als (7)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (19)
Externe Belege — Patches, Meldungen, Analysen.
- https://access.redhat.com/security/cve/CVE-2024-8775cnnvd
- https://bugzilla.redhat.com/show_bug.cgi?id=2312119cnnvd
- https://cxsecurity.com/cveshow/CVE-2024-8775/cnnvd
- https://vigilance.fr/vulnerability/ansible-core-three-vulnerabilities-dated-04-11-2024-45521cnnvd
- https://access.redhat.com/errata/RHSA-2024:10762enisa_euvd
- https://access.redhat.com/errata/RHSA-2024:8969enisa_euvd
- https://access.redhat.com/errata/RHSA-2024:9894enisa_euvd
- https://access.redhat.com/errata/RHSA-2025:1249enisa_euvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan