NetSight
IP …
high7.8

CVE-2019-14846

Ansible Uses Plugins That Disclose Credentials

Impact

Ansible, all ansible_engine-2.x versions and ansible_engine-3.x up to ansible_engine-3.5, was logging at the DEBUG level which lead to a disclosure of credentials if a plugin used a library that logged credentials at the DEBUG level. This flaw does not affect Ansible modules, as those are executed in a separate process.

Affected packages

EcosystemPackageAffectedFixed in
pipansible>= 0, < 2.6.202.6.20

Affected products

VendorProductAffected versions
RedhatAnsible Engine
before 2.6.20
from 2.7.0 before 2.7.14
from 2.8.0 before 2.8.6
Versions 2.0, 2.8.0
DebianDebian Linux
Versions 8.0, 9.0, 10.0
OpensuseBackports Sle
Version 15.0
OpensuseLeap
Version 15.1
RedhatOpenstack
Version 13

Weakness classification

CWE-117CWE-532

References