PYSEC-2019-141: Medium severity Ansible Ansible vulnerability

Q: Which deployments are affected?

Ansible versions before 2.5.14, 2.6.11, and 2.7.5 are affected when run in vvv+ verbosity mode with no_log enabled.

Q: What could an attacker obtain?

The flaw can disclose sensitive data that no_log is intended to suppress. The provided data does not identify specific data types or output locations.

Q: What access is required to exploit this issue?

The severity vector indicates network access, low privileges, no user interaction, and high attack complexity. The provided information does not further specify the required Ansible role or access path.

Published Jan 3, 2019

Updated

ansible before versions 2.5.14, 2.6.11, 2.7.5 is vulnerable to a information disclosure flaw in vvv+ mode with nolog on that can lead to leakage of sensible data.

Affected Software

1 affected component

Ansible Ansible<2.5.14, <2.6.11, <2.7.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ansible to a version that resolves this vulnerability.
Fixed in 2.5.14
Upgrade
Upgrade ansible to a version that resolves this vulnerability.
Fixed in 2.6.11
Upgrade
Upgrade ansible to a version that resolves this vulnerability.
Fixed in 2.7.5

Event History

Jan 3, 2019

CVE Published

via OSV·03:29 PM

Data Sourced

via OSV·03:29 PM

DescriptionSeverity

Frequently Asked Questions

Which deployments are affected?

Ansible versions before 2.5.14, 2.6.11, and 2.7.5 are affected when run in vvv+ verbosity mode with no_log enabled.

What could an attacker obtain?

The flaw can disclose sensitive data that no_log is intended to suppress. The provided data does not identify specific data types or output locations.

What access is required to exploit this issue?

The severity vector indicates network access, low privileges, no user interaction, and high attack complexity. The provided information does not further specify the required Ansible role or access path.

PYSEC-2019-141: Medium severity Ansible Ansible vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What could an attacker obtain?

What access is required to exploit this issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What could an attacker obtain?

What access is required to exploit this issue?