CVE-2019-14858
ansible: sub parameters marked as no_log are not masked in certain failure scenarios
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. When a module has an argument_spec with sub parameters marked as no_log, passing an invalid parameter name to the module will cause the task to fail before the no_log options in the sub parameters are processed. As a result, data in the sub parameter fields will not be masked and will be displayed if Ansible is run with increased verbosity and present in the module invocation arguments for the task.
Se detectó una vulnerabilidad en Ansible engine versión 2.x hasta 2.8 y Ansible tower versión 3.x hasta 3.5. Cuando un módulo tiene un argumento_spec con subparámetros marcados como no_log, pasar un nombre de parámetro no válido al módulo hará que la tarea falle antes de que se procesen las opciones no_log en los subparámetros. Como resultado, los datos en los campos de subparámetro no se enmascararán y se mostrarán si Ansible se ejecuta con mayor detalle y está presente en los argumentos de invocación del módulo para la tarea.
A flaw was found in ansible. When a module has an argument_spec with sub parameters marked as no_log, passing an invalid parameter name to the module will cause the task to fail before the no_log options in the sub parameters are processed. As a result, data in the sub parameter fields will not be masked and will be displayed if Ansible is run with increased verbosity and present in the module invocation arguments for the task.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2019-08-10 CVE Reserved
- 2019-10-14 CVE Published
- 2024-08-05 CVE Updated
- 2024-10-07 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-117: Improper Output Neutralization for Logs
- CWE-532: Insertion of Sensitive Information into Log File
CAPEC
References (10)
URL | Tag | Source |
---|---|---|
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14858 | Issue Tracking |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Redhat Search vendor "Redhat" | Ansible Engine Search vendor "Redhat" for product "Ansible Engine" | >= 2.0 <= 2.8.0 Search vendor "Redhat" for product "Ansible Engine" and version " >= 2.0 <= 2.8.0" | - |
Affected
| ||||||
Redhat Search vendor "Redhat" | Ansible Tower Search vendor "Redhat" for product "Ansible Tower" | >= 3.0 <= 3.5.0 Search vendor "Redhat" for product "Ansible Tower" and version " >= 3.0 <= 3.5.0" | - |
Affected
|