CVE-2019-14864

MEDIUM6.5EPSS 0.86%

Inclusion of Sensitive Information in Log Files and Improper Output Neutralization for Logs in Ansible

Published: 2/26/2020Modified: 4/28/2026

Description

Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumologic and Splunk callback plugins are used send tasks results events to collectors. This would discloses and collects any sensitive data.

Affected packages (4)

Alpine/ansiblefrom 0, < 2.8.8-r0
Debian/ansiblefrom 0, < 2.9.2+dfsg-1
PyPI/ansible>= 2.7.0a1, < 2.7.15
PyPI/ansible>= 2.7.0, < 2.7.15, >= 2.8.0, < 2.8.7, >= 2.9.0, < 2.9.1

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References (19)

ADVISORYhttps://github.com/advisories/GHSA-3m93-m4q6-mc6v
ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2019-14864
ADVISORYhttps://security.alpinelinux.org/vuln/CVE-2019-14864
ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2019-14864
PATCHhttps://github.com/ansible/ansible
WEBhttp://lists.opensuse.org/opensuse-security-announce/2020-04/msg00021.html
WEBhttp://lists.opensuse.org/opensuse-security-announce/2020-04/msg00026.html
WEBhttps://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14864
WEBhttps://github.com/ansible/ansible/commit/050f92f96054bf59e283fdec9972323c2ed00348
WEBhttps://github.com/ansible/ansible/commit/75288a89d0053d6df35c90863fb6c9542d89850e
WEBhttps://github.com/ansible/ansible/commit/a0ec2976b2716cdecdd7a8f416d96406acd79b7c
WEBhttps://github.com/ansible/ansible/commit/c76e074e4c71c7621a1ca8159261c1959b5287af
WEBhttps://github.com/ansible/ansible/issues/63522
WEBhttps://github.com/ansible/ansible/pull/63527
WEBhttps://github.com/ansible/ansible/pull/64273
WEBhttps://github.com/ansible/ansible/pull/64274
WEBhttps://github.com/ansible/ansible/pull/64748
WEBhttps://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2020-160.yaml
WEBhttps://www.debian.org/security/2021/dsa-4950