CVE-2019-14864

mediumpriority · track · 27EPSS 0.019 · 79 %ileDEEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

1.87% (79th) EPSS

CVSS 4 · medium

Is it mine?

54 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-27

Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumologic and Splunk callback plugins are used send tasks results events to collectors. This would discloses and collects any sensitive data.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

Fixedansible-0:2.9.1-1.el7.noarch as a component of Red Hat Ansible Engine 2 for RHEL 7redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:3928
Fixedansible-0:2.9.1-1.el7.src as a component of Red Hat Ansible Engine 2 for RHEL 7redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:3928
Fixedansible-0:2.9.1-1.el8.noarch as a component of Red Hat Ansible Engine 2 for RHEL 8redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:3928
Fixedansible-0:2.9.1-1.el8.src as a component of Red Hat Ansible Engine 2 for RHEL 8redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:3928
Fixedansible-test-0:2.9.1-1.el7.noarch as a component of Red Hat Ansible Engine 2 for RHEL 7redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:3928
Fixedansible-test-0:2.9.1-1.el8.noarch as a component of Red Hat Ansible Engine 2 for RHEL 8redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:3928

cvss

Technical severity, 0–10. One row per scoring source.

6.5

010

base score 0–10 · higher = more severe · hover a vector to decode

v2.04mediumAV:N/AC:L/Au:S/C:P/I:N/A:Nprimary · NVD / NIST USexploitability 8 · impact 2.9

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:Nprimary · NVD / NIST USexploitability 2.8 · impact 3.6

v3.05.7mediumCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:Nsecondary · secalert@redhat.com USexploitability 2.1 · impact 3.6

v3.05.7mediumCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:Nsecondary · Red Hat Product Security US

v3.05.7mediumCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:Nsecondary · ENISA EU

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:Nsecondary · OSV

v3.16mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

v3.16.5mediumAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:Nsecondary · FSTEC (BDU) RU

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-117USCWE-117USCWE-213USCWE-532USCWE-532USCWE-532US

affected products (54)

Products and version ranges known to be affected.

Debian Linuxall versionscert_bundDEcpe:/o:debian:debian_linux:-
Open Source Ansible <2.7.15all versionscert_bundDE
Open Source Ansible <2.8.7all versionscert_bundDE
Open Source Ansible <2.9.1all versionscert_bundDE
Open Source Ansible Tower 3.5all versionscert_bundDEcpe:/a:open_source:ansible_tower:3.5
Open Source Ansible Tower 3.6all versionscert_bundDEcpe:/a:open_source:ansible_tower:3.6
Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
SUSE Linuxall versionscert_bundDEcpe:/o:suse:suse_linux:-
SUSE openSUSEall versionscert_bundDEcpe:/o:suse:opensuse:-
Open Source Ansible< 2.7.15cert_bundDE
Open Source Ansible< 2.8.7cert_bundDE
Open Source Ansible< 2.9.1cert_bundDE
Red Hat Ansible≤ Ansible versions 2.7.x before 2.7.15enisa_euvdEU
Red Hat Ansible≤ Ansible versions 2.9.x before 2.9.1enisa_euvdEU
Red Hat Ansible≤ Ansible versions 2.8.x before 2.8.7enisa_euvdEU
Novell Inc. OpenSUSE Leap≤ 15.1fstec_bduRU
Red Hat Inc. Ansible2.7.0 → 2.7.15fstec_bduRU
Red Hat Inc. Ansible2.8.0 → 2.8.7fstec_bduRU
Red Hat Inc. Ansible2.9.0 → 2.9.1fstec_bduRU
Red Hat Inc. Ansible Tower≤ 3fstec_bduRU

showing 20 of 54

advisories (5)

Vendor and ecosystem advisories describing this.

RHSA-2019:3928Red Hat Security Advisory: ansible security and bug fix update2019-11-20csaf · redhat_csafUS
An update for Ansible is now available for Ansible Engine 2.9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
WID-SEC-W-2024-3592Ansible: Schwachstelle ermöglicht Offenlegung von InformationenDeutsch2019-11-20csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Ansible ausnutzen, um Informationen offenzulegen.
WID-SEC-W-2026-1810Ansible Tower: Mehrere SchwachstellenDeutsch2019-12-16csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Ansible Tower ausnutzen, um Informationen offenzulegen und um Sicherheitsmechanismen zu umgehen.
GHSA-3m93-m4q6-mc6vInclusion of Sensitive Information in Log Files and Improper Output Neutralization for Logs in Ansible2020-02-26ghsa · osvUS
Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumologic and Splunk callback plugins are used send tasks results events to collectors. This would discloses and collects any sensitive data.
PYSEC-2020-1602020-01-02vendor · osvUS
Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumologic and Splunk callback plugins are used send tasks results events to collectors. This would discloses and collects any sensitive data.

also known as (7)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv cert_bund redhat_csaf NVD CVE.org MITRE

published 2020-01-02modified 2026-06-17

references (33)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan