id: PYSEC-2017-4
details: A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before
  2.4.1) passed certain parameters to the jenkins_plugin module. Remote attackers
  could use this flaw to expose sensitive information from a remote host's logs. This
  flaw was fixed by not allowing passwords to be specified in the "params" argument,
  and noting this in the module documentation.
affected:
- package:
    name: ansible
    ecosystem: PyPI
    purl: pkg:pypi/ansible
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: 2.3.0.0
    - fixed: 2.3.3.0
    - introduced: 2.4.0.0
    - fixed: 2.4.1.0
  versions:
  - 2.3.0.0
  - 2.3.1.0
  - 2.3.2.0
  - 2.4.0.0
references:
- type: REPORT
  url: https://github.com/ansible/ansible/issues/30874
- type: REPORT
  url: https://bugzilla.redhat.com/show_bug.cgi?id=1473645
- type: ADVISORY
  url: https://access.redhat.com/errata/RHSA-2017:2966
- type: ADVISORY
  url: https://github.com/advisories/GHSA-588w-w6mv-3cw5
aliases:
- CVE-2017-7550
- GHSA-588w-w6mv-3cw5
modified: "2021-07-02T02:41:33.938371Z"
published: "2017-11-21T17:29:00Z"