Executive brief
Ansible is a popular automation and configuration management tool used to deploy and manage IT infrastructure. The no_log flag, which prevents sensitive data like passwords and API keys from being logged, was not properly respected by the Sumologic and Splunk callback plugins. This allowed sensitive information to be sent unencrypted to monitoring and logging systems, potentially exposing credentials to anyone with access to those systems.
Technical details
The vulnerability is an improper implementation of the no_log flag in Ansible's Sumologic and Splunk callback plugins (CWE-532: Inclusion of Sensitive Information in Log Files). When tasks are marked with no_log set to True, the plugins were still sending task results containing sensitive data to external collectors. The vulnerability affects Ansible 2.7.x before 2.7.15, 2.8.x before 2.8.7, and 2.9.x before 2.9.1. An attacker with access to Sumologic or Splunk collector systems would be able to retrieve exposed credentials and other sensitive information. Patches are available in versions 2.7.15, 2.8.7, 2.9.1 and later.
Affected products
- Ansible Ansible 2.7.0 through 2.7.14, 2.8.0 through 2.8.6, 2.9.0
Timeline
- 2020-02-26: disclosed: GHSA advisory published
- 2020: patched: Fixed in versions 2.7.15, 2.8.7, 2.9.1