CVE-2017-7550 – ansible: jenkins_plugin module exposes passwords in remote host logs

https://notcve.org/view.php?id=CVE-2017-7550

A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkins_plugin module. Remote attackers could use this flaw to expose sensitive information from a remote host's logs. This flaw was fixed by not allowing passwords to be specified in the "params" argument, and noting this in the module documentation. Se encontró un fallo en la manera en la que Ansible (en versiones 2.3.x anteriores a la 2.3.3 y versiones 2.4.x anteriores a la 2.4.1) pasaba algunos parámetros al módulo jenkins_plugin. Los atacantes remotos podrían utilizar este fallo para exponer información sensible de los logs de un host remoto. • https://access.redhat.com/errata/RHSA-2017:2966 https://bugzilla.redhat.com/show_bug.cgi?id=1473645 https://github.com/ansible/ansible/issues/30874 https://access.redhat.com/security/cve/CVE-2017-7550 • CWE-532: Insertion of Sensitive Information into Log File •