CVE-2019-14864CWE-117CWE-532
Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when…
Medium · published January 2, 2020
What it is
Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumologic and Splunk callback plugins are used send tasks results events to collectors. This would discloses and collects any sensitive data.
The record
Technical detail
- CVSS v3.0
- 5.7 · MEDIUM
- Vector
- CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.01873 · 79.2th percentile
- Weaknesses
- CWE-117 · Improper Output Neutralization for Logs; CWE-532 · Insertion of Sensitive Information into Log File
- Published
- 2020-01-02T14:23Z
EPSS history
Timeline
02 JAN 14:23Z
Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when…
cvelistv5