p PatchFirst

CVE-2019-14864

CVE-2019-14864

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumologic and Splunk callback plugins are used send tasks results events to collectors. This would discloses and collects any sensitive data.

CVSS 5.7 · Medium · EPSS 1.9% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • ansible

    Versions
    • Ansible versions 2.9.x before 2.9.1: Affected
    • Ansible versions 2.8.x before 2.8.7: Affected
    • Ansible versions 2.7.x before 2.7.15: Affected

    No fix published

  • ansible Debian:12

    Affected ranges
    • ECOSYSTEM: < 2.9.2+dfsg-1

    Update to 2.9.2+dfsg-1

  • ansible Debian:13

    Affected ranges
    • ECOSYSTEM: < 2.9.2+dfsg-1

    Update to 2.9.2+dfsg-1

  • ansible Debian:14

    Affected ranges
    • ECOSYSTEM: < 2.9.2+dfsg-1

    Update to 2.9.2+dfsg-1

  • ansible PyPI

    Versions
    • 2.7.0
    • 2.7.0a1
    • 2.7.0b1
    • 2.7.0rc1
    • 2.7.0rc2
    • 2.7.0rc3
    • 2.7.0rc4
    • 2.7.1
    • 2.7.10
    • 2.7.11
    • 2.7.12
    • 2.7.13
    • 2.7.14
    • 2.7.2
    • 2.7.3
    • 2.7.4
    • 2.7.5
    • 2.7.6
    • 2.7.7
    • 2.7.8
    • 2.7.9
    Affected ranges
    • ECOSYSTEM: ≥ 2.7.0a1, < 2.7.15

    Update to 2.7.15

  • ansible PyPI

    Versions
    • 2.8.0
    • 2.8.0a1
    • 2.8.0b1
    • 2.8.0rc1
    • 2.8.0rc2
    • 2.8.0rc3
    • 2.8.1
    • 2.8.2
    • 2.8.3
    • 2.8.4
    • 2.8.5
    • 2.8.6
    Affected ranges
    • ECOSYSTEM: ≥ 2.8.0a1, < 2.8.7

    Update to 2.8.7

  • ansible PyPI

    Versions
    • 2.9.0
    • 2.9.0b1
    • 2.9.0rc1
    • 2.9.0rc2
    • 2.9.0rc3
    • 2.9.0rc4
    • 2.9.0rc5
    Affected ranges
    • ECOSYSTEM: ≥ 2.9.0a1, < 2.9.1

    Update to 2.9.1

  • ansible PyPI

    Versions
    • 2.7.0
    • 2.7.1
    • 2.7.2
    • 2.7.3
    • 2.7.4
    • 2.7.5
    • 2.7.6
    • 2.7.7
    • 2.7.8
    • 2.7.9
    • 2.7.10
    • 2.7.11
    • 2.7.12
    • 2.7.13
    • 2.7.14
    • 2.8.0
    • 2.8.1
    • 2.8.2
    • 2.8.3
    • 2.8.4
    • 2.8.5
    • 2.8.6
    • 2.9.0
    Affected ranges
    • ECOSYSTEM: ≥ 2.7.0, < 2.7.15 ∪ ≥ 2.8.0, < 2.8.7 ∪ ≥ 2.9.0, < 2.9.1

    Update to 2.7.15; Update to 2.8.7; Update to 2.9.1

Original sources

Check your server →