Skip to content

Sensitive password field exposed when the task of checking deprecated privileges settings is skipped due to with_items loop #279

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
wants to merge 1 commit into from
Closed

Sensitive password field exposed when the task of checking deprecated privileges settings is skipped due to with_items loop #279

wants to merge 1 commit into from

Conversation

maarous
Copy link

@maarous maarous commented Jun 3, 2025

When the role runs the task:

- name: Ensure PostgreSQL users do not use deprecated privileges settings
  debug:
    msg "Postgresql user {{ item.name }} uses deprecated privileges settings. See https://github.com/geerlingguy/ansible-role-postgresql/issues/254"
  with_items: "{{ postgresql_users }}"
  when: item.priv is defined

Ansible prints the full contents of item in the skipped message, which includes sensitive fields such as the PostgreSQL user's password.
Example output:

TASK [geerlingguy.postgresql : Ensure PostgreSQL users do not use deprecated privileges settings] ***********************************************************
skipping: [boo.example.com] => (item={'name': 'example_user', 'password': 'xDsfdsf8v4Zz', 'encrypted': True, 'db': 'foo_db', 'login_host': 'localhost', 'port': 5432, 'state': 'present'})

This results in a security risk, as sensitive values are exposed even though the task itself is skipped and does not explicitly log them.

@maarous maarous mentioned this pull request Jun 3, 2025
Closed
zerwes added a commit to Rosa-Luxemburgstiftung-Berlin/ansible-role-postgresql that referenced this pull request Jun 4, 2025
@zerwes
hide sensitive data (see pr geerlingguy#279)
734541d
@zerwes
Copy link
Contributor

zerwes commented Jun 4, 2025

Hello @maarous
👍 for pointing at this
As my fix for the fix (pr #267 as a fup to #266) is still unmerged, I implemented a different solution in 734541d by changing the loop label.

@maarous
Copy link
Author

maarous commented Jun 4, 2025

Hello @zerwes , your fix is much better. Thanks !! It was merged.

@maarous maarous closed this Jun 4, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@maarous @zerwes