Lucene search

K

GoogleOSV:GHSA-3M93-M4Q6-MC6V

HistoryFeb 26, 2020 - 7:54 p.m.

Inclusion of Sensitive Information in Log Files and Improper Output Neutralization for Logs in Ansible

2020-02-2619:54:31

Google

osv.dev

6

0.003 Low

EPSS

Percentile

68.5%

Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumologic and Splunk callback plugins are used send tasks results events to collectors. This would discloses and collects any sensitive data.

CPENameOperatorVersion
ansibleeq2.8.3
ansibleeq2.7.15
ansibleeq2.9.1
ansibleeq2.7.2
ansibleeq2.7.7
ansibleeq2.7.5
ansibleeq2.8.4
ansibleeq2.8.6
ansibleeq2.7.0
ansibleeq2.7.12

Rows per page:

1-10 of 261

References

lists.opensuse.org/opensuse-security-announce/2020-04/msg00021.html

lists.opensuse.org/opensuse-security-announce/2020-04/msg00026.html

bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14864

github.com/ansible/ansible/commit/75288a89d0053d6df35c90863fb6c9542d89850e

github.com/ansible/ansible/issues/63522

github.com/ansible/ansible/pull/63527

github.com/ansible/ansible/pull/64273

github.com/ansible/ansible/pull/64274

github.com/ansible/ansible/pull/64748

nvd.nist.gov/vuln/detail/CVE-2019-14864

www.debian.org/security/2021/dsa-4950

0.003 Low

EPSS

Percentile

68.5%

Related for OSV:GHSA-3M93-M4Q6-MC6V

mageia1 veracode1 redhat5 nessus9 nvd1 github1 prion1 cvelist1 redhatcve1 symantec1 osv3 alpinelinux1 cve1 ubuntucve1 openvas3 debiancve1 photon4 suse2 debian1