Ansible Uses Plugins That Disclose Credentials

高 7.8CVE-2019-14846 · GHSA-pm48-cvv2-29q5 · PYSEC-2019-4 · 08/10/2019 公開 · 17/06/2026 更新

要点

CVE-2019-14846 は ansible, backports sle (opensuse), ansible engine (redhat) に影響する深刻度「高」 (CVSS 7.8) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.51%（全脆弱性の 43.8% より高い）。
対処：2.7.14, 2.8.6, 2.6.20 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
ansible PyPI	`≥ 2.7.0, < 2.7.14≥ 2.7.0a1, < 2.7.14≥ 2.8.0, < 2.8.6≥ 2.8.0a1, < 2.8.6< 2.6.20`	`2.7.142.8.62.6.20`
backports sle opensuse	`= 15.0`	修正版なし
ansible engine redhat	`= 2.0= 2.8.0≥ 2.7.0, < 2.7.14≥ 2.8.0, < 2.8.6< 2.6.20`	`2.7.142.8.62.6.20`
openstack redhat	`= 13`	修正版なし

概要

Ansible, all ansible_engine-2.x versions and ansible_engine-3.x up to ansible_engine-3.5, was logging at the DEBUG level which lead to a disclosure of credentials if a plugin used a library that logged credentials at the DEBUG level. This flaw does not affect Ansible modules, as those are executed in a separate process.

NVD の説明

In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG level which lead to a disclosure of credentials if a plugin used a library that logged credentials at the DEBUG level. This flaw does not affect Ansible modules, as those are executed in a separate process.