CVE-2019-14846
08.10.2019, 19:15
In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG level which lead to a disclosure of credentials if a plugin used a library that logged credentials at the DEBUG level. This flaw does not affect Ansible modules, as those are executed in a separate process.Enginsight
| Vendor | Product | Version |
|---|---|---|
| redhat | ansible_engine | 𝑥 < 2.6.20 |
| redhat | ansible_engine | 2.7.0 ≤ 𝑥 < 2.7.14 |
| redhat | ansible_engine | 2.8.0 ≤ 𝑥 < 2.8.6 |
| debian | debian_linux | 8.0 |
| debian | debian_linux | 9.0 |
| debian | debian_linux | 10.0 |
| opensuse | backports_sle | 15.0:sp1 |
| opensuse | leap | 15.1 |
| redhat | ansible_engine | 2.0 |
| redhat | ansible_engine | 2.8.0 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Common Weakness Enumeration
- CWE-117 - Improper Output Neutralization for LogsThe software does not neutralize or incorrectly neutralizes output that is written to logs.
- CWE-532 - Insertion of Sensitive Information into Log FileInformation written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
References