GitHub Advisoryadvisory · PyPI

GHSA-grgm-pph5-j5h7 Exposure of Sensitive Information to an Unauthorized Actor in ansible

MEDIUM Published 2019-07-31 Modified 2024-09-04 Official page ↗
Aliases
CVE-2019-10156
Ecosystem
PyPI
Packages
ansible
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-200
Reviewed
2019-07-31

Affected packages

• PyPI ansible: < 2.6.18 → fixed in 2.6.18 • PyPI ansible: >= 2.7.0a1, < 2.7.12 → fixed in 2.7.12 • PyPI ansible: >= 2.8.0a1, < 2.8.2 → fixed in 2.8.2

Description

A flaw was discovered in the way Ansible templating was implemented in versions before 2.6.18, 2.7.12 and 2.8.2, causing the possibility of information disclosure through unexpected variable substitution. By taking advantage of unintended variable substitution the content of any variable may be disclosed.

Related

Alias · CVE (1)

  • CVE-2019-10156 A flaw was discovered in the way Ansible templating was implemented in versions before 2.6.18, 2.7.12 and 2.8.2, causing the possibility of… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References