QwikSec

Security Database

CVE

CWE

Training

CVE-2019-14864

Published: Jan 2, 2020

Modified: Aug 5, 2024

PUBLISHED

CVSS v3.0

5.7

MEDIUM

Description

Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumologic and Splunk callback plugins are used send tasks results events to collectors. This would discloses and collects any sensitive data.

Vendor	Product	Versions
Red Hat	Ansible	affected `Ansible versions 2.9.x before 2.9.1` affected `Ansible versions 2.8.x before 2.8.7` affected `Ansible versions 2.7.x before 2.7.15`

Weaknesses (CWE)

CVSS v3.0 Details

CVSS v3.0 Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14864

x_refsource_CONFIRM

https://github.com/ansible/ansible/issues/63522

x_refsource_MISC

https://github.com/ansible/ansible/pull/63527

x_refsource_MISC

openSUSE-SU-2020:0513

vendor-advisory

x_refsource_SUSE

openSUSE-SU-2020:0523

vendor-advisory

x_refsource_SUSE

vendor-advisory

x_refsource_DEBIAN

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.