CVSS: 6.5EPSS: 0%CPEs: 12EXPL: 1CVE-2019-14864 – Ansible: Splunk and Sumologic callback plugins leak sensitive data in logs
https://notcve.org/view.php?id=CVE-2019-14864
Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumologic and Splunk callback plugins are used send tasks results events to collectors. This would discloses and collects any sensitive data. Ansible, versiones 2.9.x anteriores a la versión 2.9.1, versiones 2.8.x anteriores a la versión 2.8.7 y Ansible versiones 2.7.x anteriores a la versión 2.7.15, no respeta el flag no_log, configurado en True cuando los plugins de devolución de llamada Sumologic y Splunk son usados para enviar eventos de resultados de tareas para coleccionistas. Esto revelaría y recolectaría cualquier información confidencial. A data disclosure flaw was found in Ansible when using the Splunk and Sumologic modules, as they are not respecting when the flag no_log is enabled. • http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00021.html http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00026.html https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14864 https://github.com/ansible/ansible/issues/63522 https://github.com/ansible/ansible/pull/63527 https://www.debian.org/security/2021/dsa-4950 https://access.redhat.com/security/cve/CVE-2019-14864 https://bugzilla.redhat.com/show_bug.cgi?id=1764148 • CWE-117: Improper Output Neutralization for Logs CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 7.3EPSS: 0%CPEs: 2EXPL: 0CVE-2019-14858 – ansible: sub parameters marked as no_log are not masked in certain failure scenarios
https://notcve.org/view.php?id=CVE-2019-14858
A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. When a module has an argument_spec with sub parameters marked as no_log, passing an invalid parameter name to the module will cause the task to fail before the no_log options in the sub parameters are processed. As a result, data in the sub parameter fields will not be masked and will be displayed if Ansible is run with increased verbosity and present in the module invocation arguments for the task. Se detectó una vulnerabilidad en Ansible engine versión 2.x hasta 2.8 y Ansible tower versión 3.x hasta 3.5. Cuando un módulo tiene un argumento_spec con subparámetros marcados como no_log, pasar un nombre de parámetro no válido al módulo hará que la tarea falle antes de que se procesen las opciones no_log en los subparámetros. • http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00021.html http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00026.html https://access.redhat.com/errata/RHSA-2019:3201 https://access.redhat.com/errata/RHSA-2019:3202 https://access.redhat.com/errata/RHSA-2019:3203 https://access.redhat.com/errata/RHSA-2019:3207 https://access.redhat.com/errata/RHSA-2020:0756 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14858 https://access.redhat.com/security& • CWE-117: Improper Output Neutralization for Logs CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2019-10312
https://notcve.org/view.php?id=CVE-2019-10312
A missing permission check in Jenkins Ansible Tower Plugin 0.9.1 and earlier in the TowerInstallation.TowerInstallationDescriptor#doFillTowerCredentialsIdItems method allowed attackers with Overall/Read permission to enumerate credentials ID of credentials stored in Jenkins. Una falta de comprobación de permisos en Jenkins Ansible Tower Plugin versión 0.9.1 y anteriores, en el método TowerInstallation.TowerInstallationDescriptor#doFillTowerCredentialsIdItems permitió a los atacantes con permiso Overall/Read enumerar el ID de las credenciales almacenadas en Jenkins. • http://www.openwall.com/lists/oss-security/2019/04/30/5 http://www.securityfocus.com/bid/108159 https://jenkins.io/security/advisory/2019-04-30/#SECURITY-1355 • CWE-862: Missing Authorization •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-10310
https://notcve.org/view.php?id=CVE-2019-10310
A cross-site request forgery vulnerability in Jenkins Ansible Tower Plugin 0.9.1 and earlier in the TowerInstallation.TowerInstallationDescriptor#doTestTowerConnection form validation method allowed attackers permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins Una vulnerabilidad de tipo cross-site request forgery en Jenkins Ansible Tower Plugin versión 0.9.1 y anteriores en el método de comprobación de formulario TowerInstallation.TowerInstallationDescriptor#doTestTowerConnection permitía a los atacantes permiso para conectarse a un URL especificada por el atacante mediante los identificadores de credenciales especificados por el atacante obtenidos por otro método, capturando las credenciales almacenadas en Jenkins • http://www.openwall.com/lists/oss-security/2019/04/30/5 http://www.securityfocus.com/bid/108159 https://jenkins.io/security/advisory/2019-04-30/#SECURITY-1355 https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0786 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-10311
https://notcve.org/view.php?id=CVE-2019-10311
A missing permission check in Jenkins Ansible Tower Plugin 0.9.1 and earlier in the TowerInstallation.TowerInstallationDescriptor#doTestTowerConnection form validation method allowed attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Una falta de comprobación de permiso en Jenkins Ansible Tower plugin versión 0.9.1 y versiones anteriores en el método de comprobación de formulario TowerInstallationDescriptor#doTestTowerConnection permitía a los atacantes con permiso general y de lectura conectarse a un URL especificada por el atacante usando identificadores de credenciales especificados por el atacante obtenidos por otro método, capturando las credenciales almacenadas en Jenkins. • http://www.openwall.com/lists/oss-security/2019/04/30/5 http://www.securityfocus.com/bid/108159 https://jenkins.io/security/advisory/2019-04-30/#SECURITY-1355 • CWE-862: Missing Authorization •