CVE-2020-25646 (Python, published 2020-10-29T20:15Z)
Description: value: A flaw was found in Ansible Collection community.crypto. openssl_privatekey_info exposes private key in logs. This directly impacts confidentiality
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-116 \u2014 Improper Encoding or Escaping of Output
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Repository: https://github.com/ansible-collections/community.crypto
Files changed:
changelogs/fragments/cve-2020-25646.yml
plugins/modules/openssl_csr.py
plugins/modules/openssl_privatekey.py
plugins/modules/openssl_privatekey_info.py
plugins/modules/openssl_publickey.py
plugins/modules/openssl_signature.py
plugins/modules/x509_certificate.py
plugins/modules/x509_crl.py
Commit message: CVE-2020-25646: no_log=True missing for private key content options (#125)

* Mark private key content options as no_log (CVE-2020-25646.)

* Mention no_log for openssl_privatekey's return_content option.

* Add change PR's URL.

* Plural.

Vulnerable code:
            privatekey_content=dict(type='str'),
            content=dict(type='str'),
            privatekey_content=dict(type='str'),
            privatekey_content=dict(type='str'),
            privatekey_content=dict(type='str'),
            ownca_privatekey_content=dict(type='str'),
            privatekey_content=dict(type='str'),

Fixed code:
security_fixes:
- "openssl_csr - the option ``privatekey_content`` was not marked as ``no_log``, resulting in it being dumped into the system log by default, and returned in the registered results in the ``invocation`` field (CVE-2020-25646, https://github.com/ansible-collections/community.crypto/pull/125)."
- "openssl_privatekey_info - the option ``content`` was not marked as ``no_log``, resulting in it being dumped into the system log by default, and returned in the registered results in the ``invocation`` field (CVE-2020-25646, https://github.com/ansible-collections/community.crypto/pull/125)."
- "openssl_publickey - the option ``privatekey_content`` was not marked as ``no_log``, resulting in it being dumped into the system log by default, and returned in the registered results in the ``invocation`` field (CVE-2020-25646, https://github.com/ansible-collections/community.crypto/pull/125)."
- "openssl_signature - the option ``privatekey_content`` was not marked as ``no_log``, resulting in it being dumped into the system log by default, and returned in the registered results in the ``invocation`` field (CVE-2020-25646, https://github.com/ansible-collections/community.crypto/pull/125)."
- "x509_certificate - the options ``privatekey_content`` and ``ownca_privatekey_content`` were not marked as ``no_log``, resulting in it being dumped into the system log by default, and returned in the registered results in the ``invocation`` field (CVE-2020-25646, https://github.com/ansible-collections/community.crypto/pull/125)."
- "x509_crl - the option ``privatekey_content`` was not marked as ``no_log``, resulting in it being dumped into the system log by default, and returned in the registered results in the ``invocation`` field (CVE-2020-25646, https://github.com/ansible-collections/community.crypto/pull/125)."
            privatekey_content=dict(type='str', no_log=True),
            - Use Ansible's I(no_log) task option to avoid the output being shown. See also
              U(https://docs.ansible.com/ansible/latest/reference_appendices/faq.html#how-do-i-keep-secret-data-in-my-playbook).
            content=dict(type='str', no_log=True),
            privatekey_content=dict(type='str', no_log=True),
            privatekey_content=dict(type='str', no_log=True),
            privatekey_content=dict(type='str', no_log=True),
            ownca_privatekey_content=dict(type='str', no_log=True),
            privatekey_content=dict(type='str', no_log=True),