Inclusion of Sensitive Information in Log Files and Improper Output Neutralization for Logs in Ansible
Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumologic and Splunk callback plugins are used send tasks results events to collectors. This would discloses and collects any sensitive data.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2019-14864US | medium6.5 | — | ||
Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumologic and Splunk callba… | ||||
02
references
External citations — patches, advisories, analysis.
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00021.htmlWEB
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00026.htmlWEB
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14864WEB
- https://github.com/advisories/GHSA-3m93-m4q6-mc6vADVISORY
- https://github.com/ansible/ansiblePACKAGE
- https://github.com/ansible/ansible/commit/050f92f96054bf59e283fdec9972323c2ed00348WEB
- https://github.com/ansible/ansible/commit/75288a89d0053d6df35c90863fb6c9542d89850eWEB
- https://github.com/ansible/ansible/commit/a0ec2976b2716cdecdd7a8f416d96406acd79b7cWEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan