CVE-2019-14846: High severity red hat ansible engine vulnerability
Ansible, all ansibleengine-2.x versions and ansibleengine-3.x up to ansibleengine-3.5, was logging at the DEBUG level which lead to a disclosure of credentials if a plugin used a library that logged credentials at the DEBUG level. This flaw does not affect Ansible modules, as those are executed in a separate process.
Other sources
In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG level which lead to a disclosure of credentials if a plugin used a library that logged credentials at the DEBUG level. This flaw does not affect Ansible modules, as those are executed in a separate process.
— MITRE
Secrets are disclosed on logs due to display is hardcoded to DEBUG level. This causes 'nolog’ parameter is ignored on tasks.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this Ansible vulnerability?
The vulnerability ID for this Ansible vulnerability is CVE-2019-14846.
What is the severity of CVE-2019-14846?
The severity of CVE-2019-14846 is high.
Which versions of Ansible Engine are affected by CVE-2019-14846?
All Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19 are affected by CVE-2019-14846.
How can I fix CVE-2019-14846?
To fix CVE-2019-14846, update to ansible-engine 2.8.6 for ansible-engine 2.8.x, ansible-engine 2.7.14 for ansible-engine 2.7.x, ansible-engine 2.6.20 for ansible-engine 2.6.x. For ansible-core, update to ansible-core 2.8.6. Check the provided references for more information.
Are Ansible modules affected by CVE-2019-14846?
No, Ansible modules are not affected by CVE-2019-14846.