Information disclosure in Red Hat Ansible
CVE-2019-14858
A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. When a module has an argument_spec with sub parameters marked as no_log, passing an invalid parameter name to the module will cause the task to fail before the no_log options in the sub parameters are processed. As a result, data in the sub parameter fields will not be masked and will be displayed if Ansible is run with increased verbosity and present in the module invocation arguments for the task.
EPSS: 0.004 (34.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Red Hat Ansible — versions ansible_engine-2.x up to 2.8, ansible_tower-3.x up to 3.5
- Redhat Ansible_engine
- Redhat Ansible_tower
Weakness classification (CWE)
References
- secalert@redhat.com (x_refsource_CONFIRM, Third Party Advisory, Issue Tracking)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (vendor-advisory, x_refsource_SUSE)
- secalert@redhat.com (vendor-advisory, x_refsource_SUSE)
Frequently asked questions
- What is CVE-2019-14858?
- CVE-2019-14858 is a medium-severity vulnerability in Red Hat Ansible, classified under Improper Output Neutralization for Logs. CVSS score: 5.5/10. Published 2019-10-14.
- How severe is CVE-2019-14858?
- Medium severity. CVSS v3 base score is 5.5 out of 10.