CVE-2017-7550

A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkins_plugin module. Remote attackers could use this flaw to expose sensitive information from a remote host's logs. This flaw was fixed by not allowing passwords to be specified in the "params" argument, and noting this in the module documentation.

Database specific

{
    "unresolved_ranges": [
        {
            "cpe": "cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*",
            "extracted_events": [
                {
                    "last_affected": "7.0"
                }
            ],
            "source": "CPE_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/ansible/ansible

Affected ranges

Type

GIT

Repo

https://github.com/ansible/ansible

Events

Introduced

d56ba0945dbf6c787a3e7f3e17b3db657b9dcee4

Fixed

0255ab2e27d1268faa409bff855682f2992f0f85

Introduced

d14467b0294296b9a2b85e0ad150315c2d5a2491

Fixed

e946c4b3b73be28871ab67965584e060d7da1c4b

Database specific

{
    "cpe": "cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "2.3.0"
        },
        {
            "fixed": "2.3.3"
        },
        {
            "introduced": "2.4.0"
        },
        {
            "fixed": "2.4.1"
        }
    ],
    "source": "CPE_FIELD"
}

Affected versions

v2.*

v2.3.0.0-1

v2.3.1.0-0.1.rc1

v2.3.1.0-0.2.rc2

v2.3.1.0-1

v2.3.2.0-0.1.rc1

v2.3.2.0-0.2.rc2

v2.3.2.0-0.3.rc3

v2.3.2.0-0.4.rc4

v2.3.2.0-0.5.rc5

v2.3.2.0-1

v2.3.3.0-0.1.rc1

v2.3.3.0-0.2.rc2

v2.3.3.0-0.3.rc3

v2.4.0.0-1

v2.4.1.0-0.1.beta1

v2.4.1.0-0.2.beta2

v2.4.1.0-0.3.rc1

v2.4.1.0-0.4.rc2

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-7550.json"