GHSA-3m93-m4q6-mc6v
Inclusion of Sensitive Information in Log Files and Improper Output Neutralization for Logs in Ansible
At a glance
- Published
- Updated
- CVE
- CVE-2019-14864
- Aliases
- PYSEC-2020-160
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Description
Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumologic and Splunk callback plugins are used send tasks results events to collectors. This would discloses and collects any sensitive data.
Affected packages
| Package | Versions |
|---|---|
| PyPI · ansible | introduced 2.7.0a1, fixed 2.7.15 |
| PyPI · ansible | introduced 2.8.0a1, fixed 2.8.7 |
| PyPI · ansible | introduced 2.9.0a1, fixed 2.9.1 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-14864 ADVISORY
- https://github.com/ansible/ansible/issues/63522 WEB
- https://github.com/ansible/ansible/pull/63527 WEB
- https://github.com/ansible/ansible/pull/64273 WEB
- https://github.com/ansible/ansible/pull/64274 WEB
- https://github.com/ansible/ansible/pull/64748 WEB
- https://github.com/ansible/ansible/commit/050f92f96054bf59e283fdec9972323c2ed00348 WEB
- https://github.com/ansible/ansible/commit/75288a89d0053d6df35c90863fb6c9542d89850e WEB
- https://github.com/ansible/ansible/commit/a0ec2976b2716cdecdd7a8f416d96406acd79b7c WEB
- https://github.com/ansible/ansible/commit/c76e074e4c71c7621a1ca8159261c1959b5287af WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14864 WEB
- https://github.com/advisories/GHSA-3m93-m4q6-mc6v ADVISORY
- https://github.com/ansible/ansible PACKAGE
- https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2020-160.yaml WEB
- https://www.debian.org/security/2021/dsa-4950 WEB
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00021.html WEB
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00026.html WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |