CVE-2019-10217

2019-11-2516:15:13

Google

osv.dev

6.3 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

56.3%

JSON

A flaw was found in ansible 2.8.0 before 2.8.4. Fields managing sensitive data should be set as such by no_log feature. Some of these fields in GCP modules are not set properly. service_account_contents() which is common class for all gcp modules is not setting no_log to True. Any sensitive data managed by that function would be leak as an output when running ansible playbooks.

CPENameOperatorVersion
ansible-baseeq1.5.5-r0
ansibleeq1.8.4-r0
ansible-baseeq1.0-r1
ansible-baseeq1.9.3-r0
ansible-baseeq2.4.0.0-r0
ansible-baseeq2.7.9-r0
ansible-baseeq2.5.5-r0
ansible-baseeq2.8.3-r0
ansibleeq2.4.2.0-r0
ansibleeq1.7.1-r0

Name	Operator	Version
ansible-base	eq	1.5.5-r0
ansible	eq	1.8.4-r0
ansible-base	eq	1.0-r1
ansible-base	eq	1.9.3-r0
ansible-base	eq	2.4.0.0-r0
ansible-base	eq	2.7.9-r0
ansible-base	eq	2.5.5-r0
ansible-base	eq	2.8.3-r0
ansible	eq	2.4.2.0-r0
ansible	eq	1.7.1-r0