CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NCVE-2019-14864
Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumologic and Splunk callback plugins are used send tasks results events to collectors. This would discloses and collects any sensitive data.
Severity
- EPSS
- 1.9% chance of exploitation in the next 30 days; higher than 79% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-117, CWE-532
- Published
- Modified
- Record from
- the NVD, synced
Affected
- debian:debian_linux
- opensuse:backports_sle
- opensuse:leap
- redhat:ansible
- redhat:ansible_tower
- redhat:ceph_storage
- redhat:cloudforms_management_engine
- redhat:enterprise_linux
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-3m93-m4q6-mc6v | PyPI | ansible | >=2.7.0a1 <2.7.15 | 2.7.15 |
| GHSA-3m93-m4q6-mc6v | PyPI | ansible | >=2.8.0a1 <2.8.7 | 2.8.7 |
| GHSA-3m93-m4q6-mc6v | PyPI | ansible | >=2.9.0a1 <2.9.1 | 2.9.1 |
| PYSEC-2020-160 | PyPI | ansible | >=2.7.0 <2.7.15 >=2.8.0 <2.8.7 >=2.9.0 <2.9.1 | 2.7.15, 2.8.7, 2.9.1 |