CVE-2019-14864

MEDIUM6.5EPSS 0.86%

Inclusion of Sensitive Information in Log Files and Improper Output Neutralization for Logs in Ansible

發布日:2020/2/26修改日:2026/4/28

描述

Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumologic and Splunk callback plugins are used send tasks results events to collectors. This would discloses and collects any sensitive data.

受影響套件(4)

Alpine/ansiblefrom 0, < 2.8.8-r0
Debian/ansiblefrom 0, < 2.9.2+dfsg-1
PyPI/ansible>= 2.7.0a1, < 2.7.15
PyPI/ansible>= 2.7.0, < 2.7.15, >= 2.8.0, < 2.8.7, >= 2.9.0, < 2.9.1

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	MEDIUM6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

參考連結(19)

ADVISORYhttps://github.com/advisories/GHSA-3m93-m4q6-mc6v
ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2019-14864
ADVISORYhttps://security.alpinelinux.org/vuln/CVE-2019-14864
ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2019-14864
PATCHhttps://github.com/ansible/ansible
WEBhttp://lists.opensuse.org/opensuse-security-announce/2020-04/msg00021.html
WEBhttp://lists.opensuse.org/opensuse-security-announce/2020-04/msg00026.html
WEBhttps://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14864
WEBhttps://github.com/ansible/ansible/commit/050f92f96054bf59e283fdec9972323c2ed00348
WEBhttps://github.com/ansible/ansible/commit/75288a89d0053d6df35c90863fb6c9542d89850e
WEBhttps://github.com/ansible/ansible/commit/a0ec2976b2716cdecdd7a8f416d96406acd79b7c
WEBhttps://github.com/ansible/ansible/commit/c76e074e4c71c7621a1ca8159261c1959b5287af
WEBhttps://github.com/ansible/ansible/issues/63522
WEBhttps://github.com/ansible/ansible/pull/63527
WEBhttps://github.com/ansible/ansible/pull/64273
WEBhttps://github.com/ansible/ansible/pull/64274
WEBhttps://github.com/ansible/ansible/pull/64748
WEBhttps://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2020-160.yaml
WEBhttps://www.debian.org/security/2021/dsa-4950