Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumologic and Splunk callback plugins are used send tasks results events to collectors. This would discloses and collects any sensitive data.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2019-14864US | medium6.5 | — | ||
Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumologic and Splunk callba… | ||||
02
references
External citations — patches, advisories, analysis.
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00021.htmlWEB
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00026.htmlWEB
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14864REPORT
- https://github.com/advisories/GHSA-3m93-m4q6-mc6vADVISORY
- https://github.com/ansible/ansible/issues/63522REPORT
- https://github.com/ansible/ansible/pull/63527WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan