GitHub Advisoryadvisory · PyPI
GHSA-6fq2-x65v-v9h7 Ansible password prompts could expose passwords
HIGH
Official page ↗
- Aliases
- CVE-2019-14856
- Ecosystem
- PyPI
- Packages
- ansible
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-287
- Reviewed
- 2023-10-19
Affected packages
• PyPI ansible: >= 2.8.0, < 2.8.6 → fixed in 2.8.6
• PyPI ansible: >= 2.7.0, < 2.7.14 → fixed in 2.7.14
• PyPI ansible: >= 2.6.0, < 2.6.20 → fixed in 2.6.20
Description
A data disclosure flaw was found in ansible. Password prompts in ansible-playbook and ansible-cli tools could expose passwords with special characters as they are not properly wrapped. A password with special characters is exposed starting with the first of these special characters. The highest threat from this vulnerability is to data confidentiality.
This CVE exists due to an incomplete fix for CVE-2019-10206.
Related
Alias · CVE (1)
- CVE-2019-14856 ansible before versions 2.8.6, 2.7.14, 2.6.20 is vulnerable to a None vulnerability
Weakness · CWE (1)
- CWE-287 Improper Authentication weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-14856 advisory
- https://github.com/ansible/ansible/pull/63351 web
- https://github.com/ansible/ansible/commit/16684f118715a52e1c46d437652add9ca36423de web
- https://github.com/ansible/ansible/commit/2cbd8775ca1271195169f62122df1f88b532e74f web
- https://github.com/ansible/ansible/commit/40618d70e61af1123907a5fb246cc4fd35f1e5c3 web
- https://github.com/ansible/ansible/commit/7f4befdea77045fa83b5f2b304bd5e16b219f74c web
- https://access.redhat.com/errata/RHSA-2020:0756 web
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14856 web
- https://github.com/ansible/ansible package
- https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2019-146.yaml web
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00021.html web
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00026.html web