PT-2019-5284 · Red Hat+3 · Ansible+3

Pedro Sampaio · Published 2019-11-26 · Updated 2025-11-21 · CVE-2019-14856

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Ansible versions prior to 2.8.6 Ansible versions prior to 2.7.14 Ansible versions prior to 2.6.20

Description The issue is related to insufficient input validation in the Ansible configuration management system. This could allow a remote attacker to gain unauthorized access to protected information. A data disclosure flaw was found in Ansible, where password prompts in ansible-playbook and ansible-cli tools could expose passwords with special characters, as they are not properly wrapped. The highest threat from this issue is to data confidentiality.

Recommendations For versions prior to 2.8.6, update to version 2.8.6 or later. For versions prior to 2.7.14, update to version 2.7.14 or later. For versions prior to 2.6.20, update to version 2.6.20 or later.

Fix

RCE

Improper Authentication

Weakness Enumeration

CWE-20

CWE-287

Related Identifiers

ALT-PU-2020-1453

ALT-PU-2020-1490

BDU:2020-02200

CVE-2019-14856

GHSA-6FQ2-X65V-V9H7

OPENSUSE-SU-2020:0513-1

OPENSUSE-SU-2020:0523-1

OPENSUSE-SU-2020_0513-1

OPENSUSE-SU-2024:10615-1

OPENSUSE-SU-2024:14244-1

OPENSUSE-SU-2024:14536-1

OPENSUSE-SU-2025:15605-1

OPENSUSE-SU-2025:15753-1

PYSEC-2019-146

RHSA-2019:3201

RHSA-2019:3202

RHSA-2019:3203

RHSA-2019:3207

RHSA-2020:0756

SUSE-SU-2020:3309-1

Affected Products

Alt Linux

Ansible

Ansible-Core

Suse

References · 161

• https://bdu.fstec.ru/vul/2020-02200 · Security Note
• https://osv.dev/vulnerability/GHSA-6fq2-x65v-v9h7 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2019-146 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2020:0756 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2019-14856 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-14856 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00021.html · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14856 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:0513-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-14856 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14244-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14536-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:3309-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:0523-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15605-1 · Vendor Advisory