Inclusion of Sensitive Information in Log Files - CVE-2019-14858

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU33375

Inclusion of Sensitive Information in Log Files - CVE-2019-14858

Published: October 14, 2019 / Updated: August 4, 2020


Vulnerability identifier: #VU33375
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-14858
CWE-ID: CWE-532
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local authenticated user to gain access to sensitive information.

A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. When a module has an argument_spec with sub parameters marked as no_log, passing an invalid parameter name to the module will cause the task to fail before the no_log options in the sub parameters are processed. As a result, data in the sub parameter fields will not be masked and will be displayed if Ansible is run with increased verbosity and present in the module invocation arguments for the task.


Affected software

ansible (Alpine package)
Red Hat OpenStack
Red Hat OpenStack for IBM Power
Red Hat OpenStack Director Deployment Tools
SUSE Linux
Opensuse
Ansible

How to mitigate CVE-2019-14858

Install update from vendor's website.

ansible (Alpine package) - update to 2.6.20-r0
Ansible - update to 2.6.20-1.el7ae

External References

Related Security Bulletins