UBUNTU-CVE-2023-4380

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2023-4380

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-4380.json

JSON Data

https://api.test.osv.dev/v1/vulns/UBUNTU-CVE-2023-4380

Upstream

CVE-2023-4380

Published

2023-10-04T15:15:00Z

Modified

2026-01-20T17:52:46.968150Z

Severity

6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

A logic flaw exists in Ansible Automation platform. Whenever a private project is created with incorrect credentials, they are logged in plaintext. This flaw allows an attacker to retrieve the credentials from the log, resulting in the loss of confidentiality, integrity, and availability.

References

Affected packages

Ubuntu:22.04:LTS

ansible-core

Package

Name: ansible-core
Purl: pkg:deb/ubuntu/ansible-core@2.12.0-1ubuntu0.1?arch=source&distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.12.0-1

2.12.0-1ubuntu0.1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "ansible-core",
            "binary_version": "2.12.0-1ubuntu0.1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-4380.json"

Ubuntu:24.04:LTS

ansible

Package

Name: ansible
Purl: pkg:deb/ubuntu/ansible@9.2.0+dfsg-0ubuntu5?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

7.*

7.7.0+dfsg-1

7.7.0+dfsg-3

9.*

9.2.0+dfsg-0ubuntu4

9.2.0+dfsg-0ubuntu5

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "ansible",
            "binary_version": "9.2.0+dfsg-0ubuntu5"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-4380.json"

ansible-core

Package

Name: ansible-core
Purl: pkg:deb/ubuntu/ansible-core@2.16.3-0ubuntu2?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.14.9-2

2.14.11-1

2.14.11-2

2.14.13-1

2.16.3-0ubuntu1

2.16.3-0ubuntu2

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "ansible-core",
            "binary_version": "2.16.3-0ubuntu2"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-4380.json"

Ubuntu:25.10

ansible

Package

Name: ansible
Purl: pkg:deb/ubuntu/ansible@12.0.0~b1+dfsg-1?arch=source&distro=questing

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

11.*

11.2.0+dfsg-1

12.*

12.0.0~a2+dfsg-1

12.0.0~a4+dfsg-1

12.0.0~a6+dfsg-1

12.0.0~b1+dfsg-1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "ansible",
            "binary_version": "12.0.0~b1+dfsg-1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-4380.json"

ansible-core

Package

Name: ansible-core
Purl: pkg:deb/ubuntu/ansible-core@2.19.0-1ubuntu1?arch=source&distro=questing

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.18.1-4ubuntu1

2.19.0~beta4-1ubuntu1

2.19.0-1ubuntu1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "ansible-core",
            "binary_version": "2.19.0-1ubuntu1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-4380.json"

Ubuntu:Pro:14.04:LTS

ansible

Package

Name: ansible
Purl: pkg:deb/ubuntu/ansible@1.5.4+dfsg-1ubuntu0.1~esm3?arch=source&distro=esm-infra-legacy/trusty

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.1+dfsg-1

1.3.4+dfsg-1

1.4.0+dfsg-1

1.4.1+dfsg-1

1.4.3+dfsg-1

1.4.4+dfsg-1

1.5.4+dfsg-1

1.5.4+dfsg-1ubuntu0.1~esm1

1.5.4+dfsg-1ubuntu0.1~esm2

1.5.4+dfsg-1ubuntu0.1~esm3

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "ansible",
            "binary_version": "1.5.4+dfsg-1ubuntu0.1~esm3"
        },
        {
            "binary_name": "ansible-fireball",
            "binary_version": "1.5.4+dfsg-1ubuntu0.1~esm3"
        },
        {
            "binary_name": "ansible-node-fireball",
            "binary_version": "1.5.4+dfsg-1ubuntu0.1~esm3"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-4380.json"

Ubuntu:Pro:16.04:LTS

ansible

Package

Name: ansible
Purl: pkg:deb/ubuntu/ansible@2.0.0.2-2ubuntu1.3+esm6?arch=source&distro=esm-apps/xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.9.2+dfsg-2

1.9.4-1

2.*

2.0.0.2-2

2.0.0.2-2ubuntu1

2.0.0.2-2ubuntu1.1

2.0.0.2-2ubuntu1.2

2.0.0.2-2ubuntu1.3

2.0.0.2-2ubuntu1.3+esm1

2.0.0.2-2ubuntu1.3+esm2

2.0.0.2-2ubuntu1.3+esm3

2.0.0.2-2ubuntu1.3+esm4

2.0.0.2-2ubuntu1.3+esm5

2.0.0.2-2ubuntu1.3+esm6

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "ansible",
            "binary_version": "2.0.0.2-2ubuntu1.3+esm6"
        },
        {
            "binary_name": "ansible-fireball",
            "binary_version": "2.0.0.2-2ubuntu1.3+esm6"
        },
        {
            "binary_name": "ansible-node-fireball",
            "binary_version": "2.0.0.2-2ubuntu1.3+esm6"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-4380.json"

Ubuntu:Pro:18.04:LTS

ansible

Package

Name: ansible
Purl: pkg:deb/ubuntu/ansible@2.5.1+dfsg-1ubuntu0.1+esm5?arch=source&distro=esm-apps/bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.3.1.0+dfsg-2

2.5.0+dfsg-1

2.5.1+dfsg-1

2.5.1+dfsg-1ubuntu0.1

2.5.1+dfsg-1ubuntu0.1+esm1

2.5.1+dfsg-1ubuntu0.1+esm2

2.5.1+dfsg-1ubuntu0.1+esm3

2.5.1+dfsg-1ubuntu0.1+esm4

2.5.1+dfsg-1ubuntu0.1+esm5

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "ansible",
            "binary_version": "2.5.1+dfsg-1ubuntu0.1+esm5"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-4380.json"

Ubuntu:Pro:20.04:LTS

ansible

Package

Name: ansible
Purl: pkg:deb/ubuntu/ansible@2.9.6+dfsg-1ubuntu0.1~esm3?arch=source&distro=esm-apps/focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.8.3+dfsg-1

2.8.6+dfsg-1

2.9.2+dfsg-1

2.9.4+dfsg-1

2.9.6+dfsg-1

2.9.6+dfsg-1ubuntu0.1~esm1

2.9.6+dfsg-1ubuntu0.1~esm2

2.9.6+dfsg-1ubuntu0.1~esm3

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "ansible",
            "binary_version": "2.9.6+dfsg-1ubuntu0.1~esm3"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-4380.json"

Ubuntu:Pro:22.04:LTS

ansible

Package

Name: ansible
Purl: pkg:deb/ubuntu/ansible@2.10.7+merged+base+2.10.8+dfsg-1ubuntu0.1~esm4?arch=source&distro=esm-apps/jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.10.7+merged+base+2.10.8+dfsg-1

2.10.7+merged+base+2.10.8+dfsg-1ubuntu0.1~esm1

2.10.7+merged+base+2.10.8+dfsg-1ubuntu0.1~esm4

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "ansible",
            "binary_version": "2.10.7+merged+base+2.10.8+dfsg-1ubuntu0.1~esm4"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-4380.json"