GitHub Advisoryadvisory · PyPI

GHSA-cqmr-rcpr-cxh3 Ansible password prompts could expose passwords

HIGH Published 2022-05-24 Modified 2024-11-18 Official page ↗
Aliases
CVE-2019-10206
Ecosystem
PyPI
Packages
ansible
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-20, CWE-522
Reviewed
2022-10-07

Affected packages

• PyPI ansible: >= 2.8.0, < 2.8.4 → fixed in 2.8.4 • PyPI ansible: >= 2.7.0, < 2.7.13 → fixed in 2.7.13 • PyPI ansible: >= 2.6.0, < 2.6.19 → fixed in 2.6.19

Description

ansible-playbook -k and ansible cli tools, all versions 2.8.x before 2.8.4, all 2.7.x before 2.7.13 and all 2.6.x before 2.6.19, prompt passwords by expanding them from templates as they could contain special characters. Passwords should be wrapped to prevent templates trigger and exposing them.

Related

Alias · CVE (1)

  • CVE-2019-10206 ansible-playbook -k and ansible cli tools, all versions 2.8.x before 2.8.4, all 2.7.x before 2.7.13 and all 2.6.x before 2.6.19, prompt… vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-522 Insufficiently Protected Credentials weakness

References