← Back

CVE-2020-1753

nvd nist
Published: Mar 16, 2020Modified: Jun 17, 2026

JSON object

Loading...
5.5
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Exploitability: 1.8 / Impact: 3.6
Source: NVD

Description

A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prior to 2.8.11 and all Ansible 2.9.x versions prior to 2.9.7, when managing kubernetes using the k8s module. Sensitive parameters such as passwords and tokens are passed to kubectl from the command line, not using an environment variable or an input configuration file. This will disclose passwords and tokens from process list and no_log directive from debug module would not have any effect making these secrets being disclosed on stdout and log files.

Affected (11)

2 products
Ansible Engine
Ansible Tower
1 product
Debian Linux
1 product
Fedora
Configuration A
7 vulnerable
Vulnerable SoftwareAffected Versions
Redhat
Before 2.7.18
From 2.8.0 to 2.8.11
From 2.9.0 to 2.9.7
Redhat
Up to 3.3.4
From 3.4.0 to 3.4.5
From 3.5.0 to 3.5.5
From 3.6.0 to 3.6.3
Configuration B
1 vulnerable
Vulnerable SoftwareAffected Versions
Version 10.0
Configuration C
3 vulnerable
Vulnerable SoftwareAffected Versions
Fedoraproject
Version 30
Version 31
Version 32

References (14)

Source: secalert@redhat.com
Issue TrackingVendor Advisory
Source: secalert@redhat.com
ExploitPatchThird Party Advisory
Source: secalert@redhat.com
Third Party Advisory
Source: secalert@redhat.com
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Issue TrackingVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitPatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory

Timeline

No history available yet.