A flaw was found in the Ansible Engine when using module_args. Tasks executed with check mode (--check-mode) do not properly neutralize sensitive data exposed in the event data. This flaw allows unauthorized users to read this data. The highest threat from this vulnerability is to confidentiality.
The product constructs a log message from external input, but it does not neutralize or incorrectly neutralizes special elements when the message is written to a log file.
The product writes sensitive information to a log file.
Link | Tags |
---|---|
https://github.com/ansible/ansible/pull/71033 | third party advisory patch |
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14332 | issue tracking vendor advisory |
https://www.debian.org/security/2021/dsa-4950 | third party advisory vendor advisory |