CVE-2019-14858

MEDIUM

Ansible Engine 2.0-2.8.0 and Ansible Tower 3.0-3.5.0 - Sensitive Information Disclosure in Log Files

Title source: llm
STIX 2.1

Description

A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. When a module has an argument_spec with sub parameters marked as no_log, passing an invalid parameter name to the module will cause the task to fail before the no_log options in the sub parameters are processed. As a result, data in the sub parameter fields will not be masked and will be displayed if Ansible is run with increased verbosity and present in the module invocation arguments for the task.

References (8)

Core 8
Core References
Issue Tracking, Third Party Advisory x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14858
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:3203
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:3202
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:3207
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:3201
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2020:0756

Scores

CVSS v3 5.5
EPSS 0.0042
EPSS Percentile 34.6%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-117 CWE-532
Status published
Products (3)
pypi/ansible 2.9.0a1 - 2.9.0rc4PyPI
redhat/ansible_engine 2.0 - 2.8.0
redhat/ansible_tower 3.0 - 3.5.0
Published Oct 14, 2019
Tracked Since Feb 18, 2026