The version of ansible installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-0690 advisory.

  - An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG     configuration in some scenarios. Information is still included in the output in certain tasks, such as     loop items. Depending on the task, this issue May include sensitive information, such as decrypted secret     values. (CVE-2024-0690)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the ansible package has been released.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-2246 advisory.

    - Fix CVE-2024-0690 (possible information leak in tasks that ignore       ANSIBLE_NO_LOG configuration) (RHEL-22124)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-2024_3043 advisory.

    * ansible-core: possible information leak in tasks that ignore ANSIBLE_NO_LOG configuration     (CVE-2024-0690)

    Bug Fix(es):

    * Update ansible-core to 2.16.3 (JIRA:Rocky Linux-23782)

    * Rebuild ansible-core with python 3.12 (JIRA:Rocky Linux-24141)

    This advisory is provided by Ctrl IQ, Inc for Rocky Linux systems. For more information about CIQ security     practices, visit https://ciq.com/security.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1779801095 advisory.

  - An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG     configuration in some scenarios. Information is still included in the output in certain tasks, such as     loop items. Depending on the task, this issue may include sensitive information, such as decrypted secret     values. (CVE-2024-0690)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 7.02, has ansible-core packages installed that are affected by multiple vulnerabilities:

  - An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG     configuration in some scenarios. Information is still included in the output in certain tasks, such as     loop items. Depending on the task, this issue may include sensitive information, such as decrypted secret     values. (CVE-2024-0690)

  - A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections     using the hostvars object to reference and execute templated content. This issue can lead to arbitrary     code execution if remote data or module outputs are improperly templated within playbooks.
    (CVE-2024-11079)

  - A flaw was found in Ansible, where sensitive information stored in Ansible Vault files can be exposed in     plaintext during the execution of a playbook. This occurs when using tasks such as include_vars to load     vaulted variables without setting the no_log: true parameter, resulting in sensitive data being printed in     the playbook output or logs. This can lead to the unintentional disclosure of secrets like passwords or     API keys, compromising security and potentially allowing unauthorized access or actions. (CVE-2024-8775)

  - A flaw was found in Ansible. The ansible-core `user` module can allow an unprivileged user to silently     create or replace the contents of any file on any system path and take ownership of it when a privileged     user executes the `user` module against the unprivileged user's home directory. If the unprivileged user     has traversal permissions on the directory containing the exploited target file, they retain full control     over the contents of the file as its owner. (CVE-2024-9902)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-cfa5a5cbac advisory.

    Mitigate CVE-2024-0690

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-0d894565a0 advisory.

    Mitigate CVE-2024-0690

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1509-1 advisory.

    POS_Image-Graphical7 was updated to version 0.1.1710765237.46af599:

    - Version 0.1.1710765237.46af599

      * Moved image services to dracut-saltboot package
      * Use salt bundle

    - Version 0.1.1645440615.7f1328c

      * Removed deprecated kiwi functions

    POS_Image-JeOS7 was updated to version 0.1.1710765237.46af599:

    - Version 0.1.1710765237.46af599

      * Moved image services to dracut-saltboot package
      * Use salt bundle

    - Version 0.1.1645440615.7f1328c

      * Removed deprecated kiwi functions

    ansible received the following fixes:

    - Security issues fixed:

      * CVE-2023-5764: Address issues where internal templating can cause unsafe         variables to lose their unsafe designation (bsc#1216854)

        - Breaking changes:
          assert - Nested templating may result in an inability for the conditional           to be evaluated. See the porting guide for more information.

      * CVE-2024-0690: Address issue where ANSIBLE_NO_LOG was ignored (bsc#1219002)
      * CVE-2020-14365: Ensure that packages are GPG validated (bsc#1175993)
      * CVE-2020-10744: Fixed insecure temporary directory creation (bsc#1171823)
      * CVE-2018-10874: Fixed inventory variables loading from current working directory when running ad-hoc     command that         can lead to code execution (bsc#1099805)

    - Bugs fixed:

      * Don't Require python-coverage, it is needed only for testing (bsc#1177948)

    dracut-saltboot was updated to version 0.1.1710765237.46af599:

    - Version 0.1.1710765237.46af599

      * Load only first available leaseinfo (bsc#1221092)

    - Version 0.1.1681904360.84ef141

    grafana was updated to version 9.5.18:

    - Grafana now requires Go 1.20
    - Security issues fixed:

      * CVE-2024-1313: Require same organisation when deleting snapshots (bsc#1222155)
      * CVE-2023-6152: Add email verification when updating user email (bsc#1219912)

    - Other non-security related changes:

      * Version 9.5.17:

        - [FEATURE] Alerting: Backport use Alertmanager API v2

      * Version 9.5.16:

        - [BUGFIX] Annotations: Split cleanup into separate queries and           deletes to avoid deadlocks on MySQL

      * Version 9.5.15:

        - [FEATURE] Alerting: Attempt to retry retryable errors

      * Version 9.5.14:

        - [BUGFIX] Alerting: Fix state manager to not keep           datasource_uid and ref_id labels in state after Error
        - [BUGFIX] Transformations: Config overrides being lost when           config from query transform is applied
        - [BUGFIX] LDAP: Fix enable users on successfull login

      * Version 9.5.13:

        - [BUGFIX] BrowseDashboards: Only remember the most recent           expanded folder
        - [BUGFIX] Licensing: Pass func to update env variables when           starting plugin

      * Version 9.5.12:

        - [FEATURE] Azure: Add support for Workload Identity           authentication

      * Version 9.5.9:

        - [FEATURE] SSE: Fix DSNode to not panic when response has empty           response
        - [FEATURE] Prometheus: Handle the response with different field           key order
        - [BUGFIX] LDAP: Fix user disabling

    mgr-daemon was updated to version 4.3.9-0:

    - Version 4.3.9-0

      * Update translation strings

    spacecmd was updated to version 4.3.27-0:

    - Version 4.3.27-0

      * Update translation strings

    spacewalk-client-tools was updated to version 4.3.19-0:

    - Version 4.3.19-0

      * Update translation strings

    spacewalk-koan was updated to version version 4.3.6-0:

    - Version 4.3.6-0

      * Change Docker image location for test

    uyuni-common-libs was updated to version 4.3.10-0:

    - Version 4.3.10-0

      * Add support for package signature type V4 RSA/SHA384
      * Add support for package signature type V4 RSA/SHA512 (bsc#1221465)

    uyuni-proxy-systemd-services was updated to version 4.3.12-0:

    - Version 4.3.12-0

      * Update to SUSE Manager 4.3.12

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-3043 advisory.

    - Fix CVE-2024-0690 (possible information leak in tasks that ignore       ANSIBLE_NO_LOG configuration) (RHEL-22123)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0733 advisory.

    Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing     IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to     individual teams, while automation developers retain the freedom to write tasks that leverage existing     knowledge without the overhead. Ansible Automation Platform makes it possible for users across an     organization to share, vet, and manage automation content by means of a simple, powerful, and agentless     language.

    Security Fix(es):

    * ansible-core: possible information leak in tasks that ignore ANSIBLE_NO_LOG configuration     (CVE-2024-0690)

    * automation-controller: urllib3: Cookie request header isn't stripped during cross-origin     (CVE-2023-43804)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Updates and fixes for automation controller:
    * Fixed jobs stuck in pending state after connection to database recover (AAP-19618)
    * Added secure flag option for userLoggedIn cookie if 'SESSION_COOKIE_SECURE' is set to 'True' (AAP-19602)
    * Fixed 'twilio_backend.py' to send SMS to multiple destinations (AAP-19284)
    * Fixed rsyslogd from unexpectedly stop sending events to Splunk HTTP Collector and recover rsyslog from     4xx errors (AAP-19069)
    * Fixed a TypeError in the  Logging Settings Edit form of the automation controller user interface to no     longer render the form inputs inaccessible (AAP-18960)
    * Fixed Delinea (previously: Thycotic) DevOps Secrets Vault credential plugin to work with python-dsv-     sdk>=1.0.4 (AAP-18701)
    * Updated schedule Prompt on launch fields to persist while editing (AAP-13859)
    * automation-controller has been updated to 4.5.1

    Note: The 2.4-5 installer/setup should be used to update automation controller to 4.5.1

    Updates and fixes for ansible-core:
    * ansible-core has been updated to 2.15.9

    Updates and fixes for installer, setup and setup bundle:
    * Fixed the version check when pinning EDA to an older version (AAP-19399)
    * Fixed rsyslogd from unexpectedly stop sending events to Splunk HTTP Collector and recover rsyslog from     4xx errors (AAP-19069)
    * Automation Hub now uses system crypto-policies in nginx (AAP-18974)
    * installer, setup and setup bundle have been updated to 2.4-5

    Additionally, setup bundle 2.4-5 includes the updates released in the following advisories:

    RHSA-2024:0322
    * python3-dynaconf/python39-dynaconf 3.1.12-2
    * python3-gitpython/python39-gitpython 3.1.40
    * python3-twisted/python39-twisted 23.10.0

    RHBA-2023:7863
    * container images

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:0192 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2024-0690:
    An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG     configuration in some scenarios. Information is still included in the output in certain tasks, such as     loop items. Depending on the task, this issue may include sensitive information, such as decrypted secret     values.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2024-8083:01 advisory.

    * ansible-core: possible information leak in tasks that ignore ANSIBLE_NO_LOG configuration     (CVE-2024-0690)     Bug Fix(es):
      * Update ansible-core to 2.14.14 (JIRA:RHEL-23783)     CVE-2024-0690     An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG     configuration in some scenarios. Information is still included in the output in certain tasks, such as     loop items. Depending on the task, this issue may include sensitive information, such as decrypted secret     values.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2024-8343:02 advisory.

    * ansible-core: possible information leak in tasks that ignore ANSIBLE_NO_LOG configuration     (CVE-2024-0690)     Bug Fix(es):
      * Update ansible-core to 2.16.3 (JIRA:RHEL-23782)
      * Rebuild ansible-core with python 3.12 (JIRA:RHEL-24141)     CVE-2024-0690     An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG     configuration in some scenarios. Information is still included in the output in certain tasks, such as     loop items. Depending on the task, this issue may include sensitive information, such as decrypted secret     values.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
201817	CBL Mariner 2.0 Security Update: ansible (CVE-2024-0690)	Nessus	MarinerOS Local Security Checks	2024/7/3	2026/1/21	medium
204243	Photon OS 5.0: Ansible PHSA-2024-5.0-0199	Nessus	PhotonOS Local Security Checks	2024/7/24	2026/10/13	medium
195070	Oracle Linux 9 : ansible-core (ELSA-2024-2246)	Nessus	Oracle Linux Local Security Checks	2024/5/6	2025/9/9	medium
332647	Photon OS 5.0: Ansible PHSA-2024-5.0-91-0199	Nessus	PhotonOS Local Security Checks	2026/8/5	2026/11/2	medium
353684	Rocky Linux 8 [CIQ] Security Update: ansible-core / ansible-test (crlsa-2024_3043)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	medium
361431	AlmaLinux 9.2 [TuxCare] Security Update: ansible-core / ansible-test (ALMALINUX9.2:CLSA-2026:1779801095)	Nessus	Alma Linux Local Security Checks	2026/10/1	2026/10/1	medium
242815	NewStart CGSL MAIN 7.02 : ansible-core Multiple Vulnerabilities (NS-SA-2025-0114)	Nessus	NewStart CGSL Local Security Checks	2025/7/25	2025/10/24	high
189312	Fedora 38 : ansible-core (2024-cfa5a5cbac)	Nessus	Fedora Local Security Checks	2024/1/22	2024/11/14	medium
189381	Fedora 39 : ansible-core (2024-0d894565a0)	Nessus	Fedora Local Security Checks	2024/1/23	2024/11/14	medium
195097	SUSE SLES15: POS_Image-Graphical7 / POS_Image-JeOS7 / ansible / ansible-doc / etc (SUSE-SU-2024:1509-1)	Nessus	SuSE Local Security Checks	2024/5/7	2026/6/26	critical
197986	Oracle Linux 8 : ansible-core (ELSA-2024-3043)	Nessus	Oracle Linux Local Security Checks	2024/5/28	2025/9/9	medium
194414	RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update (Moderate) (RHSA-2024:0733)	Nessus	Red Hat Local Security Checks	2024/4/28	2026/1/21	critical
238637	TencentOS Server 3: ansible-core bug fix, enhancement, and (TSSA-2024:0192)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/20	medium
292007	MiracleLinux 9 : ansible-core-2.14.14-1.el9.ML.1 (AXSA:2024-8083:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	medium
292589	MiracleLinux 8 : ansible-core-2.16.3-2.el8.ML.1 (AXSA:2024-8343:02)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium

high

medium

medium

critical

medium

critical

medium

medium

medium