Information Disclosure from HTTP URL in Ansible get_url Task

High Risk Infrastructure Security

ansibledownloadhttptlssupply-chain

What it is

Information disclosure could let attackers read or modify files, inject malware, or capture credentials via man-in-the-middle on unencrypted HTTP.

Using http:// URLs in get_url tasks to download packages or files, allowing MITM attacks.

Using http:// URLs in get_url tasks to download packages or files, allowing MITM attacks.

Falling back to HTTP mirrors when HTTPS mirrors are unavailable instead of failing safely.

Believing HTTP is significantly faster than HTTPS for downloads without measuring actual impact.

Update all get_url tasks to use https:// URLs for downloading files and packages.

Always specify checksum parameters (checksum: sha256:...) to detect tampering even if using HTTP.

Keep validate_certs: true (default) to ensure downloaded content comes from trusted sources.

Sourcery automatically identifies information disclosure from http url in ansible get_url task and many other security issues in your codebase.