CVE-2025-2877

Description

A flaw was found in the Ansible Automation Platform's Event-Driven Ansible. In configurations where verbosity is set to "debug", inventory passwords are exposed in plain text when starting a rulebook activation. This issue exists for any "debug" action in a rulebook and also affects Event Streams.

Reserved 2025-03-27 | Published 2025-03-28 | Updated 2025-05-22 | Assigner redhat

Problem types

Debug Messages Revealing Unnecessary Information

Product status

Default status
unaffected

Any version before 1.1.6
affected

Default status
affected

0:1.0.8-2.el8ap before *
unaffected

Default status
affected

0:1.0.8-2.el9ap before *
unaffected

Default status
affected

0:1.1.4-2.el8ap before *
unaffected

Default status
affected

0:1.1.4-2.el9ap before *
unaffected

Timeline

2025-03-27:	Reported to Red Hat.
2025-03-25:	Made public.

References

access.redhat.com/errata/RHSA-2025:3636 (RHSA-2025:3636) vendor-advisory

access.redhat.com/errata/RHSA-2025:3637 (RHSA-2025:3637) vendor-advisory

access.redhat.com/security/cve/CVE-2025-2877 vdb-entry

bugzilla.redhat.com/show_bug.cgi?id=2355540 (RHBZ#2355540) issue-tracking

cve.org (CVE-2025-2877)

nvd.nist.gov (CVE-2025-2877)

Download JSON