The version of ansible installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-0690 advisory.

  - An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG     configuration in some scenarios. Information is still included in the output in certain tasks, such as     loop items. Depending on the task, this issue May include sensitive information, such as decrypted secret     values. (CVE-2024-0690)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.06, has ansible-core packages installed that are affected by multiple vulnerabilities:

  - A template injection flaw was found in Ansible where a user's controller internal templating operations     may remove the unsafe designation from template data. This issue could allow an attacker to use a     specially crafted file to introduce templating injection when supplying templating data. (CVE-2023-5764)

  - An absolute path traversal attack exists in the Ansible automation platform. This flaw allows an attacker     to craft a malicious Ansible role and make the victim execute the role. A symlink can be used to overwrite     a file outside of the extraction path. (CVE-2023-5115)

  - An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG     configuration in some scenarios. Information is still included in the output in certain tasks, such as     loop items. Depending on the task, this issue may include sensitive information, such as decrypted secret     values. (CVE-2024-0690)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2024-8083:01 advisory.

    * ansible-core: possible information leak in tasks that ignore ANSIBLE_NO_LOG configuration     (CVE-2024-0690)     Bug Fix(es):
      * Update ansible-core to 2.14.14 (JIRA:RHEL-23783)     CVE-2024-0690     An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG     configuration in some scenarios. Information is still included in the output in certain tasks, such as     loop items. Depending on the task, this issue may include sensitive information, such as decrypted secret     values.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2024-8343:02 advisory.

    * ansible-core: possible information leak in tasks that ignore ANSIBLE_NO_LOG configuration     (CVE-2024-0690)     Bug Fix(es):
      * Update ansible-core to 2.16.3 (JIRA:RHEL-23782)
      * Rebuild ansible-core with python 3.12 (JIRA:RHEL-24141)     CVE-2024-0690     An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG     configuration in some scenarios. Information is still included in the output in certain tasks, such as     loop items. Depending on the task, this issue may include sensitive information, such as decrypted secret     values.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:0192 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2024-0690:
    An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG     configuration in some scenarios. Information is still included in the output in certain tasks, such as     loop items. Depending on the task, this issue may include sensitive information, such as decrypted secret     values.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0733 advisory.

    Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing     IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to     individual teams, while automation developers retain the freedom to write tasks that leverage existing     knowledge without the overhead. Ansible Automation Platform makes it possible for users across an     organization to share, vet, and manage automation content by means of a simple, powerful, and agentless     language.

    Security Fix(es):

    * ansible-core: possible information leak in tasks that ignore ANSIBLE_NO_LOG configuration     (CVE-2024-0690)

    * automation-controller: urllib3: Cookie request header isn't stripped during cross-origin     (CVE-2023-43804)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Updates and fixes for automation controller:
    * Fixed jobs stuck in pending state after connection to database recover (AAP-19618)
    * Added secure flag option for userLoggedIn cookie if 'SESSION_COOKIE_SECURE' is set to 'True' (AAP-19602)
    * Fixed 'twilio_backend.py' to send SMS to multiple destinations (AAP-19284)
    * Fixed rsyslogd from unexpectedly stop sending events to Splunk HTTP Collector and recover rsyslog from     4xx errors (AAP-19069)
    * Fixed a TypeError in the  Logging Settings Edit form of the automation controller user interface to no     longer render the form inputs inaccessible (AAP-18960)
    * Fixed Delinea (previously: Thycotic) DevOps Secrets Vault credential plugin to work with python-dsv-     sdk>=1.0.4 (AAP-18701)
    * Updated schedule Prompt on launch fields to persist while editing (AAP-13859)
    * automation-controller has been updated to 4.5.1

    Note: The 2.4-5 installer/setup should be used to update automation controller to 4.5.1

    Updates and fixes for ansible-core:
    * ansible-core has been updated to 2.15.9

    Updates and fixes for installer, setup and setup bundle:
    * Fixed the version check when pinning EDA to an older version (AAP-19399)
    * Fixed rsyslogd from unexpectedly stop sending events to Splunk HTTP Collector and recover rsyslog from     4xx errors (AAP-19069)
    * Automation Hub now uses system crypto-policies in nginx (AAP-18974)
    * installer, setup and setup bundle have been updated to 2.4-5

    Additionally, setup bundle 2.4-5 includes the updates released in the following advisories:

    RHSA-2024:0322
    * python3-dynaconf/python39-dynaconf 3.1.12-2
    * python3-gitpython/python39-gitpython 3.1.40
    * python3-twisted/python39-twisted 23.10.0

    RHBA-2023:7863
    * container images

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
201817	CBL Mariner 2.0 Security Update: ansible (CVE-2024-0690)	Nessus	MarinerOS Local Security Checks	2024/7/3	2026/1/21	medium
266241	NewStart CGSL MAIN 6.06 : ansible-core Multiple Vulnerabilities (NS-SA-2025-0244)	Nessus	NewStart CGSL Local Security Checks	2025/9/30	2025/9/30	high
292007	MiracleLinux 9 : ansible-core-2.14.14-1.el9.ML.1 (AXSA:2024-8083:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	medium
292589	MiracleLinux 8 : ansible-core-2.16.3-2.el8.ML.1 (AXSA:2024-8343:02)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	medium
238637	TencentOS Server 3: ansible-core bug fix, enhancement, and (TSSA-2024:0192)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/20	medium
194414	RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update (Moderate) (RHSA-2024:0733)	Nessus	Red Hat Local Security Checks	2024/4/28	2026/1/21	critical

检测

插件搜索

medium

high

medium

medium

medium

critical