7.3
Élevée
CVE-2019-14858 A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5
Description
A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. When a module has an argument_spec with sub parameters marked as no_log, passing an invalid parameter name to the module will cause the task to fail before the no_log options in the sub parameters are processed. As a result, data in the sub parameter fields will not be masked and will be displayed if Ansible is run with increased verbosity and present in the module invocation arguments for the task.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Ansible | Versions non publiées |
Références
- bugzilla.redhat.com bugzilla.redhat.com
- RHSA-2019:3203 access.redhat.com
- RHSA-2019:3202 access.redhat.com
- RHSA-2019:3207 access.redhat.com
- RHSA-2019:3201 access.redhat.com
- RHSA-2020:0756 access.redhat.com
- openSUSE-SU-2020:0513 lists.opensuse.org
- openSUSE-SU-2020:0523 lists.opensuse.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de Ansible
Les 29 CVE de Ansible →
CVE-2020-14332
A flaw was found in the Ansible Engine when using module_args
5.5
Moyenne
CVE-2020-14330
An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data…
5.0
Moyenne
CVE-2020-10744
An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running…
5.0
Moyenne
CVE-2020-1746
A flaw was found in the Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and…
5.0
Moyenne