ansible is vulnerable to information disclosure. The attack is possible due to an incomplete fix of CVE-2019-10206 which does not perform safe type conversions using AnsibleUnsafeBytes
and AnsibleUnsafeBytes
classes, allowing CLI provided passwords being incorrectly templated when using to_text
, to_bytes
, or to_native
during post processing of PlayContext.
lists.opensuse.org/opensuse-security-announce/2020-04/msg00021.html
lists.opensuse.org/opensuse-security-announce/2020-04/msg00026.html
access.redhat.com/errata/RHSA-2020:0756
bugzilla.redhat.com/show_bug.cgi?id=1760829
bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14856
github.com/ansible/ansible/commit/7f4befdea77045fa83b5f2b304bd5e16b219f74c
github.com/ansible/ansible/pull/63351
www.sourceclear.com/vulnerability-database/vulnerabilities/20886