PT-2020-3040 · Red Hat+4 · Ansible+4
Abhijeet Kasurde
+1
·
Published
2019-12-06
·
Updated
2025-11-21
·
CVE-2019-14864
CVSS v2.0
6.8
Medium
| Vector | AV:N/AC:L/Au:S/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Ansible versions 2.7.x through 2.7.14
Ansible versions 2.8.x through 2.8.6
Ansible versions 2.9.x through 2.9.0
Description
The issue is related to the absence of consideration for the
no log flag in Ansible's system management configuration modules for Splunk and Sumologic. This could allow a remote attacker to gain unauthorized access to protected information. The vulnerability affects Ansible when using Sumologic and Splunk callback plugins, causing the disclosure and collection of sensitive data when the no log flag is set to True.Recommendations
For Ansible versions 2.7.x through 2.7.14, update to version 2.7.15 or later to resolve the issue.
For Ansible versions 2.8.x through 2.8.6, update to version 2.8.7 or later to resolve the issue.
For Ansible versions 2.9.x through 2.9.0, update to version 2.9.1 or later to resolve the issue.
Exploit
Fix
Insertion into Log File
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Ansible
Ansible-Core
Astra Linux
Suse