CVE-2019-14858: High severity red hat ansible engine vulnerability
A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. When a module has an argumentspec with sub parameters marked as nolog, passing an invalid parameter name to the module will cause the task to fail before the nolog options in the sub parameters are processed. As a result, data in the sub parameter fields will not be masked and will be displayed if Ansible is run with increased verbosity and present in the module invocation arguments for the task.
Other sources
A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. When a module has an argumentspec with sub parameters marked as nolog, passing an invalid parameter name to the module will cause the task to fail before the nolog options in the sub parameters are processed. As a result, data in the sub parameter fields will not be masked and will be displayed if Ansible is run with increased verbosity and present in the module invocation arguments for the task.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-14858?
CVE-2019-14858 has a moderate severity rating due to its potential impact on the confidentiality of sensitive data.
How do I fix CVE-2019-14858?
To fix CVE-2019-14858, update Ansible to version 2.9.0 or later if you are using Ansible Engine, or Ansible Tower to 3.6 or later.
What versions are affected by CVE-2019-14858?
CVE-2019-14858 affects Ansible Engine versions 2.x up to 2.8 and Ansible Tower versions 3.x up to 3.5.
What are the potential risks of CVE-2019-14858?
The potential risks of CVE-2019-14858 include unauthorized data disclosure due to improper handling of module arguments.
Is there a workaround for CVE-2019-14858?
The best workaround for CVE-2019-14858 is to avoid using invalid parameter names in module arguments until a patch is applied.