CVE-2019-14864

Katalog CVE

CVSS 6.5 · Medium EPSS 1,9%

Kerentanan Improper Output Neutralization for Logs pada redhat ansible, redhat ansible tower +6 lainnya. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumologic and Splunk callback plugins are used send tasks results events to collectors. This would discloses and collects any sensitive data.

Rincian

Terbit di NVD

2 Januari 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-117: Improper Output Neutralization for Logs
CWE-532: Insertion of Sensitive Information into Log File

EPSS (30 hari)

1,9% peluang dieksploitasi; lebih tinggi dari 78,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14864 issue tracking · patch · advisory vendor
• https://github.com/ansible/ansible/pull/63527 patch · advisory vendor
• https://github.com/ansible/ansible/issues/63522 exploit · patch · advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00021.html mailing list · advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00026.html mailing list · advisory pihak ketiga
• https://www.debian.org/security/2021/dsa-4950 advisory pihak ketiga