PT-2019-5269 · Red Hat+5 · Ansible+5
Abadger
·
Publicado
2019-10-08
·
Atualizado
2026-06-03
·
CVE-2019-14846
CVSS v4.0
8.5
Alta
| Vetor | AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Ansible versions up to 2.8.5
Ansible versions up to 2.7.13
Ansible versions up to 2.6.19
Ansible versions up to 3.5
Description
The issue is related to the disclosure of information through log files in Ansible. Exploitation of this issue may allow an attacker to gain unauthorized access to protected information. The problem arises when a plugin uses a library that logs credentials at the DEBUG level. However, this flaw does not affect Ansible modules since they are executed in a separate process.
Recommendations
For versions up to 2.8.5, consider disabling the DEBUG level logging until a patch is available.
For versions up to 2.7.13, restrict access to log files to minimize the risk of exploitation.
For versions up to 2.6.19, avoid using plugins that log credentials at the DEBUG level until the issue is resolved.
For versions up to 3.5, as a temporary workaround, consider disabling the logging of credentials at the DEBUG level.
Correção
Insertion into Log File
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Ansible
Astra Linux
Linuxmint
Suse
Ubuntu