SB2019081696 - Fedora EPEL 7 update for ansible 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2019081696

SB2019081696 - Fedora EPEL 7 update for ansible

Published: August 16, 2019 Updated: April 25, 2025

Security Bulletin ID SB2019081696
Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Information disclosure (CVE-ID: CVE-2019-10217)

The vulnerability allows a remote authenticated user to gain access to sensitive information.

A flaw was found in ansible 2.8.0 before 2.8.4. Fields managing sensitive data should be set as such by no_log feature. Some of these fields in GCP modules are not set properly. service_account_contents() which is common class for all gcp modules is not setting no_log to True. Any sensitive data managed by that function would be leak as an output when running ansible playbooks.


2) Input validation error (CVE-ID: CVE-2019-10206)

The vulnerability allows a remote authenticated user to gain access to sensitive information.

ansible-playbook -k and ansible cli tools, all versions 2.8.x before 2.8.4, all 2.7.x before 2.7.13 and all 2.6.x before 2.6.19, prompt passwords by expanding them from templates as they could contain special characters. Passwords should be wrapped to prevent templates trigger and exposing them.


Remediation

Install update from vendor's website.

References