CVE-2019-14856
First published: Fri Oct 11 2019(Updated: )
A data disclosure flaw was found in ansible. Password prompts in ansible-playbook and ansible-cli tools could expose passwords with special characters as they are not properly wrapped. A password with special characters is exposed starting with the first of these special characters. The highest threat from this vulnerability is to data confidentiality. This CVE exists due to an incomplete fix for CVE-2019-10206.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Redhat Ansible | >=2.6.0<2.6.20 | |
| Redhat Ansible | >=2.7.0<2.7.14 | |
| Redhat Ansible | >=2.8.0<2.8.6 | |
| openSUSE Backports SLE | =15.0-sp1 | |
| openSUSE Leap | =15.1 | |
| Redhat Openstack | =13 | |
| redhat/ansible-engine | <2.8.6 | 2.8.6 |
| redhat/ansible-engine | <2.7.14 | 2.7.14 |
| redhat/ansible-engine | <2.6.20 | 2.6.20 |
| pip/ansible | >=2.6.0<2.6.20 | 2.6.20 |
| pip/ansible | >=2.7.0<2.7.14 | 2.7.14 |
| pip/ansible | >=2.8.0<2.8.6 | 2.8.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00021.html
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00026.html
- https://access.redhat.com/errata/RHSA-2020:0756
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14856
- https://nvd.nist.gov/vuln/detail/CVE-2019-14856
- https://github.com/ansible/ansible/pull/63351
- https://github.com/ansible/ansible/commit/7f4befdea77045fa83b5f2b304bd5e16b219f74c
- https://github.com/advisories/GHSA-6fq2-x65v-v9h7 (Advisory)
- https://access.redhat.com/security/cve/CVE-2019-10206
- https://access.redhat.com/errata/RHSA-2019:3202
- https://access.redhat.com/errata/RHSA-2019:3201
- https://access.redhat.com/errata/RHSA-2019:3203
- https://access.redhat.com/errata/RHSA-2019:3207
- https://access.redhat.com/security/cve/cve-2019-14856
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1775632
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1775633
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1775634
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1775635
- https://bugzilla.redhat.com/show_bug.cgi?id=1760829
- https://github.com/ansible/ansible/commit/16684f118715a52e1c46d437652add9ca36423de
- https://github.com/ansible/ansible/commit/2cbd8775ca1271195169f62122df1f88b532e74f
- https://github.com/ansible/ansible/commit/40618d70e61af1123907a5fb246cc4fd35f1e5c3
- https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2019-146.yaml
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2019-14856.
What is the severity of CVE-2019-14856?
CVE-2019-14856 has a severity keyword of 'medium' and a severity value of 6.5.
Which software versions are affected by CVE-2019-14856?
Affected software versions include Ansible Engine 2.8.6, 2.7.14, and 2.6.20, as well as Ansible 2.6.0 to 2.6.20 and 2.7.0 to 2.7.14 installed via pip.
How can I fix CVE-2019-14856?
To fix CVE-2019-14856, it is recommended to upgrade to Ansible Engine 2.8.6, 2.7.14, or 2.6.20, or upgrade Ansible installed via pip to versions between 2.6.0 and 2.6.20 or between 2.7.0 and 2.7.14.
Where can I find more information about CVE-2019-14856?
You can find more information about CVE-2019-14856 at the following references: [Red Hat Security Advisory](https://access.redhat.com/errata/RHSA-2019:3202) and [GitHub Pull Request](https://github.com/ansible/ansible/pull/63351).
- collector/nvd-index
- agent/author
- agent/first-publish-date
- agent/type
- agent/weakness
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2019-14856
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/description
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-6fq2-x65v-v9h7
- agent/last-modified-date
- agent/references
- agent/tags
- agent/softwarecombine
- agent/event
- collector/nvd-cve
- source/NVD
- collector/github-advisory
- vendor/redhat
- canonical/redhat ansible
- version/redhat ansible/2.6.0
- version/redhat ansible/2.7.0
- version/redhat ansible/2.8.0
- vendor/opensuse
- canonical/opensuse backports sle
- version/opensuse backports sle/15.0-sp1
- canonical/opensuse leap
- version/opensuse leap/15.1
- canonical/redhat openstack
- version/redhat openstack/13
- package-manager/redhat
- package-manager/pip