PT-2019-11640 · Red Hat+2 · Ansible+2
Ralbono
·
Published
2019-11-25
·
Updated
2025-11-21
·
CVE-2019-10217
CVSS v4.0
7.1
High
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions:
ansible versions 2.8.0 through 2.8.3
Description:
A flaw was found in the way sensitive data is handled. Fields managing sensitive data should be set as such by the no log feature. However, some fields in GCP modules are not set properly. The
service account contents() function, which is a common class for all GCP modules, is not setting no log to True. As a result, any sensitive data managed by that function would be leaked as an output when running ansible playbooks.Recommendations:
For ansible versions 2.8.0 through 2.8.3, consider setting the no log feature to True for fields managing sensitive data in GCP modules to prevent sensitive data leakage.
As a temporary workaround, consider modifying the
service account contents() function to set no log to True until a patch is available.Exploit
Fix
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Ansible-Core
Suse
Ansible