A flaw was found in Ansible. The ansible-core `user` module can allow an unprivileged user to silently create or replace the contents of any file on any system path and take ownership of it when a privileged user executes the `user` module against the unprivileged user's home directory. If the unprivileged user has traversal permissions on the directory containing the exploited target file, they retain full control over the contents of the file as its owner.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in Ansible. The ansible-core `user` module can allow an unprivileged user to silently     create or replace the contents of any file on any system path and take ownership of it when a privileged     user executes the `user` module against the unprivileged user's home directory. If the unprivileged user     has traversal permissions on the directory containing the exploited target file, they retain full control     over the contents of the file as its owner. (CVE-2024-9902)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote NewStart CGSL host, running version MAIN 7.02, has ansible-core packages installed that are affected by multiple vulnerabilities:

  - An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG     configuration in some scenarios. Information is still included in the output in certain tasks, such as     loop items. Depending on the task, this issue may include sensitive information, such as decrypted secret     values. (CVE-2024-0690)

  - A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections     using the hostvars object to reference and execute templated content. This issue can lead to arbitrary     code execution if remote data or module outputs are improperly templated within playbooks.
    (CVE-2024-11079)

  - A flaw was found in Ansible, where sensitive information stored in Ansible Vault files can be exposed in     plaintext during the execution of a playbook. This occurs when using tasks such as include_vars to load     vaulted variables without setting the no_log: true parameter, resulting in sensitive data being printed in     the playbook output or logs. This can lead to the unintentional disclosure of secrets like passwords or     API keys, compromising security and potentially allowing unauthorized access or actions. (CVE-2024-8775)

  - A flaw was found in Ansible. The ansible-core `user` module can allow an unprivileged user to silently     create or replace the contents of any file on any system path and take ownership of it when a privileged     user executes the `user` module against the unprivileged user's home directory. If the unprivileged user     has traversal permissions on the directory containing the exploited target file, they retain full control     over the contents of the file as its owner. (CVE-2024-9902)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of ansible installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-9902 advisory.

  - A flaw was found in Ansible. The ansible-core `user` module can allow an unprivileged user to silently     create or replace the contents of any file on any system path and take ownership of it when a privileged     user executes the `user` module against the unprivileged user's home directory. If the unprivileged user     has traversal permissions on the directory containing the exploited target file, they retain full control     over the contents of the file as its owner. (CVE-2024-9902)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of ansible installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-9902 advisory.

  - A flaw was found in Ansible. The ansible-core `user` module can allow an unprivileged user to silently     create or replace the contents of any file on any system path and take ownership of it when a privileged     user executes the `user` module against the unprivileged user's home directory. If the unprivileged user     has traversal permissions on the directory containing the exploited target file, they retain full control     over the contents of the file as its owner. (CVE-2024-9902)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-918 advisory.

    A flaw was found in Ansible. The ansible-core `user` module can allow an unprivileged user to silently     create or replace the contents of any file on any system path and take ownership of it when a privileged     user executes the `user` module against the unprivileged user's home directory. If the unprivileged user     has traversal permissions on the directory containing the exploited target file, they retain full control     over the contents of the file as its owner. (CVE-2024-9902)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:1861 advisory.

    An ansible-core rebuild for OpenStack based on python 3.9.

    Security Fix(es):

    * Jinja has a sandbox breakout through malicious filenames (CVE-2024-56201)

    * Jinja has a sandbox breakout through indirect reference to format method     (CVE-2024-56326)

    * Ansible-core user may read/write unauthorized content (CVE-2024-9902)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:10762 advisory.

    Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing     IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to     individual teams, while automation developers retain the freedom to write tasks that leverage existing     knowledge without the overhead. Ansible Automation Platform makes it possible for users across an     organization to share, vet, and manage automation content by means of a simple, powerful, and agentless     language.

    Security Fix(es):
    * automation-controller: dompurify: XSS vulnerability via prototype pollution (CVE-2024-45801)
    * automation-controller: path-to-regexp: Backtracking regular expressions cause ReDoS (CVE-2024-45296)
    * ansible-core: Exposure of Sensitive Information in Ansible Vault Files Due to Improper Logging     (CVE-2024-8775)
    * ansible-core: ansible-core user may read/write unauthorized content (CVE-2024-9902)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Updates and fixes for automation controller:
    * Fix job schedules running at incorrect times when rrule interval was set to HOURLY or MINUTELY     (AAP-36573)
    * Fixed an issue where sensitive data was displayed in the job output (AAP-35582)
    * With this update, you can now save a constructed inventory when verbosity is greater than 2 (AAP-35570)
    * Fix bug where unrelated jobs could be marked as a dependency of other jobs (AAP-35310)
    * Add support for receiving webhooks from Bitbucket Data Center, and add support for posting build     statuses back (AAP-35013)
    * Notification List no longer errors when notifications have a missing or null organization field     (AAP-34051)
    * Fixed an issue where Thycotic secret server credentials form fields were mis-matched (AAP-31236)
    * automation-controller has been updated to 4.5.13

    Updates and fixes for receptor:
    * Fixed an issue that caused a Receptor runtime panic error (AAP-36477)
    * receptor has been updated to 1.5.1

    Updates and fixes for installer and setup:
    * Receptor data directory can now be configured using 'receptor_datadir' variable (AAP-36699)
    * Fixed issue where metrics-utility command failed to run after updating Automation controller (AAP-36567)
    * Fix issue where the dispatcher service went into FATAL status and failed to process new jobs after a     database outage of a few minutes (AAP-36456)
    * Fixed an issue that caused incorrect IDs for RBAC in the database following a backup restore (AAP-35311)
    * With this update, installer tasks that include CA or key information are obfuscated (AAP-27480)
    * installer and setup have been updated to 2.4-8

    Note: The 2.4-8 installer can restore a backup created with 2.4-8 or later only. Ensure that you make a     backup before and after the upgrade to 2.4-8 or later.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:9894 advisory.

    Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing     IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to     individual teams, while automation developers retain the freedom to write tasks that leverage existing     knowledge without the overhead. Ansible Automation Platform makes it possible for users across an     organization to share, vet, and manage automation content by means of a simple, powerful, and agentless     language.

    Security Fix(es):

    * ansible-core: Exposure of Sensitive Information in Ansible Vault Files Due to Improper Logging     (CVE-2024-8775)
    * ansible-core: ansible-core user may read/write unauthorized content (CVE-2024-9902)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Updates and fixes included:

    Automation Platform UI
    * Fix filtering out hosts on inventory group (AAP-34752)
    * automation-gateway has been updated to 2.5.3-2

    Container-based Ansible Automation Platform
    * Fix issue when port value isn't defined in the gateway_main_url variable (AAP-34716)
    * Don't add port to image URLs when using default value (AAP-34070)
    * containerized installer setup has been updated to 2.5-4

    RPM-based Ansible Automation Platform
    * Fix issue not setting up gpg agent socket properly when multiple hub nodes are configured (AAP-34067)
    * ansible-automation-platform-installer and installer setup have been updated to 2.5-5

    Additional changes:
    * ansible-core has been updated to 2.16.13
    * molecule has been updated to 24.9.0-2

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3963 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3963-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Bastien Roucaris     November 23, 2024                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : ansible     Version        : 2.10.7+merged+base+2.10.17+dfsg-0+deb11u2     CVE ID         : CVE-2024-8775 CVE-2024-9902     Debian Bug     : 1082851

    Ansible is a command-line IT automation software application.
    It can configure systems, deploy software, and orchestrate     advanced workflows to support application deployment, system updates, ...

    Ansible was affected by two vulnerabilities:

    CVE-2024-8775

        A flaw was found in Ansible, where sensitive information stored in         Ansible Vault files can be exposed in plaintext during the execution         of a playbook. This occurs when using tasks such as include_vars to         load vaulted variables without setting the no_log: true parameter,         resulting in sensitive data being printed in the playbook output or         logs. This can lead to the unintentional disclosure of secrets like         passwords or API keys, compromising security and potentially         allowing unauthorized access or actions.

    CVE-2024-9902

        The ansible-core `user` module can allow an unprivileged user to         silently create or replace the contents of any file on any system path         and take ownership of it when a privileged user executes         the `user` module against the unprivileged user's home directory.
        If the unprivileged user has traversal permissions on the directory         containing the exploited target file, they retain full control         over the contents of the file as its owner.

    For Debian 11 bullseye, these problems have been fixed in version     2.10.7+merged+base+2.10.17+dfsg-0+deb11u2.

    We recommend that you upgrade your ansible packages.

    For the detailed security status of ansible please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/ansible

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
245016	Linux Distros Unpatched Vulnerability : CVE-2024-9902	Nessus	Misc.	medium
242815	NewStart CGSL MAIN 7.02 : ansible-core Multiple Vulnerabilities (NS-SA-2025-0114)	Nessus	NewStart CGSL Local Security Checks	high
241929	CBL Mariner 2.0 Security Update: ansible (CVE-2024-9902)	Nessus	MarinerOS Local Security Checks	medium
241882	Azure Linux 3.0 Security Update: ansible (CVE-2024-9902)	Nessus	Azure Linux Local Security Checks	medium
233701	Amazon Linux 2023 : ansible-core, ansible-test (ALAS2023-2025-918)	Nessus	Amazon Linux Local Security Checks	medium
216778	RHEL 9 : Red Hat OpenStack Platform 17.1.4 (openstack-ansible-core) (RHSA-2025:1861)	Nessus	Red Hat Local Security Checks	medium
212033	RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update (Moderate) (RHSA-2024:10762)	Nessus	Red Hat Local Security Checks	high
211764	RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.5 Product Release Update (Moderate) (RHSA-2024:9894)	Nessus	Red Hat Local Security Checks	medium
211754	Debian dla-3963 : ansible - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2024-9902

medium

Tenable Plugins

medium

high

medium

medium

medium

medium

high

medium

medium