CVE-2020-25646 — Improper Output Neutralization for Logs in Community Community Collections

CWE-117 — Improper Output Neutralization for LogsCWE-116 — Improper Encoding or Escaping of Output5 documents5 sources
Severity
7.5HIGHNVD
EPSS
0.5%
top 34.18%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Redhat AnsibleAnsible Community Community Collections
Timeline
PublishedOct 29
Latest updateMay 24

Description

A flaw was found in Ansible Collection community.crypto. openssl_privatekey_info exposes private key in logs. This directly impacts confidentiality

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5ansible_community/community_collectionsfrom 1.0.0 to 1.2.0
▶Alpineredhat/ansible< 2.10.1-r0+1

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-92hf-4chr-8hrf: A flaw was found in Ansible Collection community↗2022-05-24
▶
CVEList
CVE-2020-25646: A flaw was found in Ansible Collection community↗2020-10-29
▶
OSV
CVE-2020-25646: A flaw was found in Ansible Collection community↗2020-10-29
▶

📋Vendor Advisories

1
Debian
CVE-2020-25646: ansible - A flaw was found in Ansible Collection community.crypto. openssl_privatekey_info...↗2020
▶
CVE-2020-25646 — HIGH severity | cvebase