Input validation error in Ansible - CVE-2019-14856

Vulnerability identifier: #VU30577

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-14856

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote authenticated user to gain access to sensitive information.

ansible before versions 2.8.6, 2.7.14, 2.6.20 is vulnerable to a None

Ansible
ansible (Alpine package)
ansible
Fedora
SUSE Linux
Opensuse
Red Hat OpenStack
Red Hat OpenStack for IBM Power
Red Hat OpenStack Director Deployment Tools

Install update from vendor's website.

Ansible - addressed in versions 2.8.6, 2.6.20-1.el7ae
ansible (Alpine package) - update to 2.6.20-r0
ansible - addressed in versions 2.9.3-1.el7, 2.9.3-1.el8

• http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00021.html
• http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00026.html
• https://access.redhat.com/errata/RHSA-2020:0756
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14856

• Input validation error in Ansible
• OpenSUSE Linux update for ansible
• OpenSUSE Linux update for ansible
• Input validation error in ansible (Alpine package)
• Red Hat OpenStack Platform 13 update for ansible
• Fedora EPEL 7 update for ansible
• Fedora EPEL 8 update for ansible