Debian LTS: DLA-3963-1: ansible Security Advisory Updates
Summary
Ansible was affected by two vulnerabilities:
CVE-2024-8775
A flaw was found in Ansible, where sensitive information stored in
Ansible Vault files can be exposed in plaintext during the execution
of a playbook. This occurs when using tasks such as include_vars to
load vaulted variables without setting the no_log: true parameter,
resulting in sensitive data being printed in the playbook output or
logs. This can lead to the unintentional disclosure of secrets like
passwords or API keys, compromising security and potentially
allowing unauthorized access or actions.
CVE-2024-9902
The ansible-core `user` module can allow an unprivileged user to
silently create or replace the contents of any file on any system path
and take ownership of it when a privileged user executes
the `user` module against the unprivileged user's home directory.
If the unprivileged user has traversal permissions on the directory
containing the exploited target file, they retai...
