CVE-2017-7550

Description

A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkins_plugin module. Remote attackers could use this flaw to expose sensitive information from a remote host's logs. This flaw was fixed by not allowing passwords to be specified in the "params" argument, and noting this in the module documentation.

How to fix CVE-2017-7550

To remediate CVE-2017-7550, upgrade the affected package to a fixed version below.

• —upgrade to 2.4.2.0+dfsg-1 or later
• —upgrade to 2.4.1.0 or later
• —upgrade to 2.4.1.0 or later

Is CVE-2017-7550 being exploited?

Low — EPSS is 0.7%, meaning exploitation activity has not been observed at scale.

Affected packages (3)

• from 0, < 2.4.2.0+dfsg-1
• >= 2.4.0.0, < 2.4.1.0
• >= 2.4.0.0, < 2.4.1.0, >= 2.3.0.0, < 2.3.3.0

CVSS scores

References (10)

• ADVISORYgithub.com/advisories/GHSA-588w-w6mv-3cw5
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2017-7550
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2017-7550
• PATCHgithub.com/ansible/ansible
• WEB