Ansible password prompts could expose passwords
A data disclosure flaw was found in ansible. Password prompts in ansible-playbook and ansible-cli tools could expose passwords with special characters as they are not properly wrapped. A password with special characters is exposed starting with the first of these special characters. The highest threat from this vulnerability is to data confidentiality. This CVE exists due to an incomplete fix for CVE-2019-10206.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2019-14856US | medium6.5 | — | ||
ansible before versions 2.8.6, 2.7.14, 2.6.20 is vulnerable to a None | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00021.htmlWEB
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00026.htmlWEB
- https://access.redhat.com/errata/RHSA-2020:0756WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14856WEB
- https://github.com/ansible/ansiblePACKAGE
- https://github.com/ansible/ansible/commit/16684f118715a52e1c46d437652add9ca36423deWEB
- https://github.com/ansible/ansible/commit/2cbd8775ca1271195169f62122df1f88b532e74fWEB
- https://github.com/ansible/ansible/commit/40618d70e61af1123907a5fb246cc4fd35f1e5c3WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan