A flaw was found in ldap_attr and ldap_entry community modules for Ansbile. This issue discloses the LDAP bind password to stdout or a log file if a playbook task is written using the bind_pw in the parameters field since nothing in the params field is evaluated for sensitive data.
Created ansible tracking bugs for this issue: Affects: epel-all [bug 1808472] Affects: fedora-all [bug 1808471] Affects: openstack-rdo [bug 1808470]
Upstream fix: https://github.com/ansible/ansible/pull/67866
A workaround was posted by felixfontein. Playbooks can be rewritten like this: # Set the following variable somewhere: # ldap_auth: # server_uri: ldap://localhost/ # bind_dn: cn=admin,dc=example,dc=com # bind_pw: password # # In the example below, 'args' is a task keyword, passed at the same level as the module - name: Get rid of an unneeded attribute ldap_attr: dn: uid=jdoe,ou=people,dc=example,dc=com name: shadowExpire values: [] state: exact args: "{{ ldap_auth }}"
Mitigation: Using args keyword and embedding the ldap_auth variable instead of using bind_pw parameter would mitigate this issue.
Acknowledgments: Name: Felix Fountein
This issue has been addressed in the following products: Red Hat Ansible Engine 2.9 for RHEL 7 Red Hat Ansible Engine 2.9 for RHEL 8 Via RHSA-2020:1541 https://access.redhat.com/errata/RHSA-2020:1541
This issue has been addressed in the following products: Red Hat Ansible Engine 2 for RHEL 7 Red Hat Ansible Engine 2 for RHEL 8 Via RHSA-2020:1542 https://access.redhat.com/errata/RHSA-2020:1542
This issue has been addressed in the following products: Red Hat Ansible Engine 2.8 for RHEL 7 Red Hat Ansible Engine 2.8 for RHEL 8 Via RHSA-2020:1543 https://access.redhat.com/errata/RHSA-2020:1543
This issue has been addressed in the following products: Red Hat Ansible Engine 2.7 for RHEL 7 Via RHSA-2020:1544 https://access.redhat.com/errata/RHSA-2020:1544
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-1746
Statement: * Ansible Engine 2.7.16, 2.8.10, and 2.9.6 as well as previous versions are affected. * Ansible Tower 3.4.5, 3.5.5 and 3.6.3 as well as previous versions are affected. * Red Hat Gluster Storage and Red Hat Ceph Storage no longer maintains their own version of Ansible. The fix will be provided from core Ansible. But we still ship ansible separately for ceph ubuntu. * In Red Hat OpenStack Platform, because the flaw has a lower impact, ansible is not directly customer exposed, and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP ansible package.