CVE-2019-14856: Medium severity red hat ansible vulnerability
A data disclosure flaw was found in ansible. Password prompts in ansible-playbook and ansible-cli tools could expose passwords with special characters as they are not properly wrapped. A password with special characters is exposed starting with the first of these special characters. The highest threat from this vulnerability is to data confidentiality.
This CVE exists due to an incomplete fix for CVE-2019-10206.
Other sources
ansible before versions 2.8.6, 2.7.14, 2.6.20 is vulnerable to a None
— MITRE
The fix made in Ansible for CVE-2019-10206 was not sufficient to resolve the problem.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2019-14856.
What is the severity of CVE-2019-14856?
CVE-2019-14856 has a severity keyword of 'medium' and a severity value of 6.5.
Which software versions are affected by CVE-2019-14856?
Affected software versions include Ansible Engine 2.8.6, 2.7.14, and 2.6.20, as well as Ansible 2.6.0 to 2.6.20 and 2.7.0 to 2.7.14 installed via pip.
How can I fix CVE-2019-14856?
To fix CVE-2019-14856, it is recommended to upgrade to Ansible Engine 2.8.6, 2.7.14, or 2.6.20, or upgrade Ansible installed via pip to versions between 2.6.0 and 2.6.20 or between 2.7.0 and 2.7.14.
Where can I find more information about CVE-2019-14856?
You can find more information about CVE-2019-14856 at the following references: [Red Hat Security Advisory](https://access.redhat.com/errata/RHSA-2019:3202) and [GitHub Pull Request](https://github.com/ansible/ansible/pull/63351).