Ansible leaks sensitive information to logs when told not to

中 5.5CVE-2019-14858 · GHSA-h653-95qw-h2mp · PYSEC-2019-171 · 14/10/2019 公開 · 17/06/2026 更新

要点

CVE-2019-14858 は ansible, ansible engine (redhat), ansible tower (redhat) に影響する深刻度「中」 (CVSS 5.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.42%（全脆弱性の 36.7% より高い）。
対処：2.6.20, 2.8.1, 2.7.14, 2.8.6 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
ansible PyPI	`≥ 2.0, < 2.6.20≥ 2.0, < 2.8.1≥ 2.7.0a1, < 2.7.14≥ 2.8.0a1, < 2.8.6≥ 2.9.0a1, < 2.9.0rc4`	`2.6.202.8.12.7.142.8.62.9.0rc4`
ansible engine redhat	`≥ 2.0, ≤ 2.8.0`	修正版なし
ansible tower redhat	`≥ 3.0, ≤ 3.5.0`	修正版なし

概要

A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. When a module has an argument_spec with sub parameters marked as no_log, passing an invalid parameter name to the module will cause the task to fail before the no_log options in the sub parameters are processed. As a result, data in the sub parameter fields will not be masked and will be displayed if Ansible is run with increased verbosity and present in the module invocation arguments for the task.

NVD の説明

A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. When a module has an argument_spec with sub parameters marked as no_log, passing an invalid parameter name to the module will cause the task to fail before the no_log options in the sub parameters are processed. As a result, data in the sub parameter fields will not be masked and will be displayed if Ansible is run with increased verbosity and present in the module invocation arguments for the task.