CVE-2019-14858

MEDIUM

Ansible Engine 2.0-2.8.0 and Ansible Tower 3.0-3.5.0 - Sensitive Information Disclosure in Log Files

Title source: llm
STIX 2.1

Description

A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. When a module has an argument_spec with sub parameters marked as no_log, passing an invalid parameter name to the module will cause the task to fail before the no_log options in the sub parameters are processed. As a result, data in the sub parameter fields will not be masked and will be displayed if Ansible is run with increased verbosity and present in the module invocation arguments for the task.

References (8)

Core 8
Core References
Issue Tracking, Third Party Advisory x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14858
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:3203
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:3202
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:3207
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:3201
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2020:0756

Scores

CVSS v3 5.5
EPSS 0.0043
EPSS Percentile 33.9%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-532 CWE-117
Status published
Products (3)
pypi/ansible 2.9.0a1 - 2.9.0rc4PyPI
redhat/ansible_engine 2.0 - 2.8.0
redhat/ansible_tower 3.0 - 3.5.0
Published Oct 14, 2019
Tracked Since Feb 18, 2026