CVE-2019-14856 — medium

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

Fixedansible-0:2.7.14-1.el7ae.noarch as a component of Red Hat Ansible Engine 2.7 for RHEL 7 Serverredhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:3202
Fixedansible-0:2.7.14-1.el7ae.src as a component of Red Hat Ansible Engine 2.7 for RHEL 7 Serverredhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:3202
Fixedansible-0:2.8.6-1.el7ae.noarch as a component of Red Hat Ansible Engine 2.8 for RHEL 7 Serverredhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:3203
Fixedansible-0:2.8.6-1.el7ae.src as a component of Red Hat Ansible Engine 2.8 for RHEL 7 Serverredhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:3203
Fixedansible-0:2.8.6-1.el8ae.noarch as a component of Red Hat Ansible Engine 2.8 for RHEL 8redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:3203
Fixedansible-0:2.8.6-1.el8ae.src as a component of Red Hat Ansible Engine 2.8 for RHEL 8redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:3203
Fixedansible-0:2.8.6-1.el7ae.noarch as a component of Red Hat Ansible Engine 2 for RHEL 7redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:3207
Fixedansible-0:2.8.6-1.el7ae.src as a component of Red Hat Ansible Engine 2 for RHEL 7redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:3207
Fixedansible-0:2.8.6-1.el8ae.noarch as a component of Red Hat Ansible Engine 2 for RHEL 8redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:3207
Fixedansible-0:2.8.6-1.el8ae.src as a component of Red Hat Ansible Engine 2 for RHEL 8redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:3207
Fixedansible-0:2.6.20-1.el7ae.noarch as a component of Red Hat OpenStack Platform 13.0redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2020:0756
Fixedansible-0:2.6.20-1.el7ae.noarch as a component of Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS Serverredhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2020:0756
Fixedansible-0:2.6.20-1.el7ae.src as a component of Red Hat OpenStack Platform 13.0redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2020:0756
Fixedansible-0:2.6.20-1.el7ae.src as a component of Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS Serverredhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2020:0756

02

cvss

Technical severity, 0–10. One row per scoring source.

6.5

010

base score 0–10 · higher = more severe · hover a vector to decode

v2.04mediumAV:N/AC:L/Au:S/C:P/I:N/A:Nprimary · NVD / NIST USexploitability 8 · impact 2.9

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:Nprimary · NVD / NIST USexploitability 2.8 · impact 3.6

v3.06.4mediumCVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:Nsecondary · secalert@redhat.com USexploitability 1.2 · impact 5.2

v3.06.4mediumCVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:Nsecondary · Red Hat Product Security US

v3.06.4mediumCVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:Nsecondary · ENISA EU

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:Nsecondary · OSV

v3.16mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

v3.16.5mediumAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:Nsecondary · FSTEC (BDU) RU

03

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-287USprimaryCWE-20USCWE-287USCWE-287US

04

affected products (44)

Products and version ranges known to be affected.

[UNKNOWN] Ansible≤ 2.7.14enisa_euvdEU
[UNKNOWN] Ansible≤ 2.6.20enisa_euvdEU
[UNKNOWN] Ansible≤ 2.8.6enisa_euvdEU
Ansible Ansible Engine≤ 2.6fstec_bduRU
Novell Inc. OpenSUSE Leap≤ 15.1fstec_bduRU
Red Hat Inc. Ansible2.6.0 → 2.6.20fstec_bduRU
Red Hat Inc. Ansible2.7.0 → 2.7.14fstec_bduRU
Red Hat Inc. Ansible2.8.0 → 2.8.6fstec_bduRU
Red Hat Inc. Red Hat Ceph Storage≤ 2fstec_bduRU
Red Hat Inc. Red Hat Ceph Storage≤ 3fstec_bduRU
Red Hat Inc. Red Hat OpenStack Platform≤ 10fstec_bduRU
Red Hat Inc. Red Hat OpenStack Platform≤ 14fstec_bduRU
Red Hat Inc. Red Hat OpenStack Platform≤ 13fstec_bduRU
Red Hat Inc. Red Hat Satellite≤ 6.0fstec_bduRU
Red Hat Inc. Red Hat Storage≤ 3fstec_bduRU
АО «ИВК» Альт 8 СПall versionsfstec_bduRU
АО «Концерн ВНИИНС» ОС ОН «Стрелец»≤ 16.01.2023fstec_bduRU
АО «НППКТ» ОСОН ОСнова Оnyx≤ 2.8fstec_bduRU
Сообщество свободного программного обеспечения Debian GNU/Linux≤ 9fstec_bduRU
Сообщество свободного программного обеспечения Debian GNU/Linux≤ 8fstec_bduRU

showing 20 of 44

05

advisories (6)

Vendor and ecosystem advisories describing this.

RHSA-2019:3202Red Hat Security Advisory: Ansible security and bug fix update2019-10-24csaf · redhat_csafUS
An update is now available for Ansible Engine 2.7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
RHSA-2019:3203Red Hat Security Advisory: Ansible security and bug fix update2019-10-24csaf · redhat_csafUS
An update is now available for Ansible Engine 2.8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
RHSA-2019:3207Red Hat Security Advisory: Ansible security and bug fix update2019-10-24csaf · redhat_csafUS
An update is now available for Ansible Engine 2. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
RHSA-2020:0756Red Hat Security Advisory: ansible security update2020-03-10csaf · redhat_csafUS
An update for ansible is now available for Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
GHSA-6fq2-x65v-v9h7Ansible password prompts could expose passwords2022-05-24ghsa · osvUS
A data disclosure flaw was found in ansible. Password prompts in ansible-playbook and ansible-cli tools could expose passwords with special characters as they are not properly wrapped. A password with special characters is exposed starting with the first of these special characters. The highest threat from this vulnerability is to data confidentiality. This CVE exists due to an incomplete fix for CVE-2019-10206.
PYSEC-2019-1462019-11-26vendor · osvUS
ansible before versions 2.8.6, 2.7.14, 2.6.20 is vulnerable to a None

06

also known as (7)

Other names and identifiers for this entity.

07

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv redhat_csaf NVD CVE.org MITRE

published 2019-11-26modified 2026-06-17

08

related (7,714)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-105133US	high7.3OT critical	79.5% (100th)	KEV	2026-10-04
A vulnerability was detected in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component…
CVE-2026-82329US	—OT critical	14.4% (97th)	KEV	2026-08-28
JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileg…
CVE-2026-42018US	—OT critical	9.80% (96th)	KEV	2026-08-12
JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.
CVE-2026-65400US	—OT critical	1.72% (77th)	KEV	2026-08-06
An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1, ma…
CVE-2026-16232US	critical9.8OT critical	3.52% (89th)	KEV	2026-07-22
An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to au…

+7709 more

09

references (22)

External citations — patches, advisories, analysis.