CVSS 3.1
7.8 highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVE-2019-14846
High (7.8). EPSS 0.5% chance of exploitation in the next 30 days. Fixed in ansible 2.6.20, 2.7.14, 2.8.6.
In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG level which lead to a disclosure of credentials if a plugin used a library that logged credentials at the DEBUG level. This flaw does not affect Ansible modules, as those are executed in a separate process.
Severity
- EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 43% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-117, CWE-532
- Published
- Modified
- Record from
- the NVD, synced
Affected
- debian:debian_linux
- opensuse:backports_sle
- opensuse:leap
- redhat:ansible_engine
- redhat:openstack
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-pm48-cvv2-29q5 | PyPI | ansible | <2.6.20 | 2.6.20 |
| GHSA-pm48-cvv2-29q5 | PyPI | ansible | >=2.7.0a1 <2.7.14 | 2.7.14 |
| GHSA-pm48-cvv2-29q5 | PyPI | ansible | >=2.8.0a1 <2.8.6 | 2.8.6 |
| PYSEC-2019-4 | PyPI | ansible | <2.6.20 >=2.7.0 <2.7.14 >=2.8.0 <2.8.6 | 2.6.20, 2.7.14, 2.8.6 |