CVE-2019-14858

{"containers": {"cna": {"affected": [{"product": "Ansible", "vendor": "Red Hat", "versions": [{"status": "affected", "version": "ansible_engine-2.x up to 2.8"}, {"status": "affected", "version": "ansible_tower-3.x up to 3.5"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. When a module has an argument_spec with sub parameters marked as no_log, passing an invalid parameter name to the module will cause the task to fail before the no_log options in the sub parameters are processed. As a result, data in the sub parameter fields will not be masked and will be displayed if Ansible is run with increased verbosity and present in the module invocation arguments for the task."}], "metrics": [{"cvssV3_0": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.0"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-117", "description": "CWE-117", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-532", "description": "CWE-532", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-04-16T08:06:00.000Z", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14858"}, {"name": "RHSA-2019:3203", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2019:3203"}, {"name": "RHSA-2019:3202", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2019:3202"}, {"name": "RHSA-2019:3207", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2019:3207"}, {"name": "RHSA-2019:3201", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2019:3201"}, {"name": "RHSA-2020:0756", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2020:0756"}, {"name": "openSUSE-SU-2020:0513", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00021.html"}, {"name": "openSUSE-SU-2020:0523", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00026.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secalert@redhat.com", "ID": "CVE-2019-14858", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Ansible", "version": {"version_data": [{"version_value": "ansible_engine-2.x up to 2.8"}, {"version_value": "ansible_tower-3.x up to 3.5"}]}}]}, "vendor_name": "Red Hat"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. When a module has an argument_spec with sub parameters marked as no_log, passing an invalid parameter name to the module will cause the task to fail before the no_log options in the sub parameters are processed. As a result, data in the sub parameter fields will not be masked and will be displayed if Ansible is run with increased verbosity and present in the module invocation arguments for the task."}]}, "impact": {"cvss": [[{"vectorString": "7.3/CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.0"}]]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-117"}]}, {"description": [{"lang": "eng", "value": "CWE-532"}]}]}, "references": {"reference_data": [{"name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14858", "refsource": "CONFIRM", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14858"}, {"name": "RHSA-2019:3203", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:3203"}, {"name": "RHSA-2019:3202", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:3202"}, {"name": "RHSA-2019:3207", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:3207"}, {"name": "RHSA-2019:3201", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:3201"}, {"name": "RHSA-2020:0756", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2020:0756"}, {"name": "openSUSE-SU-2020:0513", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00021.html"}, {"name": "openSUSE-SU-2020:0523", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00026.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T00:26:39.087Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14858"}, {"name": "RHSA-2019:3203", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2019:3203"}, {"name": "RHSA-2019:3202", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2019:3202"}, {"name": "RHSA-2019:3207", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2019:3207"}, {"name": "RHSA-2019:3201", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2019:3201"}, {"name": "RHSA-2020:0756", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2020:0756"}, {"name": "openSUSE-SU-2020:0513", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00021.html"}, {"name": "openSUSE-SU-2020:0523", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00026.html"}]}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2019-14858", "datePublished": "2019-10-14T14:36:50.000Z", "dateReserved": "2019-08-10T00:00:00.000Z", "dateUpdated": "2024-08-05T00:26:39.087Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "Ansible", "vendor": "Red Hat", "versions": [{"status": "affected", "version": "ansible_engine-2.x up to 2.8"}, {"status": "affected", "version": "ansible_tower-3.x up to 3.5"}]}], "source": "secalert@redhat.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:redhat:ansible_engine:*:*:*:*:*:*:*:*", "matchCriteriaId": "C689B946-650A-48FB-AB0E-A2522EFD5B44", "versionEndIncluding": "2.8.0", "versionStartIncluding": "2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:ansible_tower:*:*:*:*:*:*:*:*", "matchCriteriaId": "08AAE3CE-F683-4811-9F05-C64353DAEDC9", "versionEndIncluding": "3.5.0", "versionStartIncluding": "3.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. When a module has an argument_spec with sub parameters marked as no_log, passing an invalid parameter name to the module will cause the task to fail before the no_log options in the sub parameters are processed. As a result, data in the sub parameter fields will not be masked and will be displayed if Ansible is run with increased verbosity and present in the module invocation arguments for the task."}, {"lang": "es", "value": "Se detect\u00f3 una vulnerabilidad en Ansible engine versi\u00f3n 2.x hasta 2.8 y Ansible tower versi\u00f3n 3.x hasta 3.5. Cuando un m\u00f3dulo tiene un argumento_spec con subpar\u00e1metros marcados como no_log, pasar un nombre de par\u00e1metro no v\u00e1lido al m\u00f3dulo har\u00e1 que la tarea falle antes de que se procesen las opciones no_log en los subpar\u00e1metros. Como resultado, los datos en los campos de subpar\u00e1metro no se enmascarar\u00e1n y se mostrar\u00e1n si Ansible se ejecuta con mayor detalle y est\u00e1 presente en los argumentos de invocaci\u00f3n del m\u00f3dulo para la tarea."}], "id": "CVE-2019-14858", "lastModified": "2026-06-17T02:19:10.957", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.1, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.3, "impactScore": 5.9, "source": "secalert@redhat.com", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-10-14T15:15:09.927", "references": [{"source": "secalert@redhat.com", "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00021.html"}, {"source": "secalert@redhat.com", "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00026.html"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2019:3201"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2019:3202"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2019:3203"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2019:3207"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2020:0756"}, {"source": "secalert@redhat.com", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14858"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00021.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00026.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://access.redhat.com/errata/RHSA-2019:3201"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://access.redhat.com/errata/RHSA-2019:3202"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://access.redhat.com/errata/RHSA-2019:3203"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://access.redhat.com/errata/RHSA-2019:3207"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://access.redhat.com/errata/RHSA-2020:0756"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14858"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-117"}, {"lang": "en", "value": "CWE-532"}], "source": "secalert@redhat.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-532"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"acknowledgement": "This issue was discovered by Sam Doran (Red Hat).", "affected_release": [{"advisory": "RHSA-2019:3201", "cpe": "cpe:/a:redhat:ansible_engine:2.6::el7", "impact": "moderate", "package": "ansible-0:2.6.20-1.el7ae", "product_name": "Red Hat Ansible Engine 2.6 for RHEL 7", "release_date": "2019-10-24T00:00:00Z"}, {"advisory": "RHSA-2019:3202", "cpe": "cpe:/a:redhat:ansible_engine:2.7::el7", "impact": "moderate", "package": "ansible-0:2.7.14-1.el7ae", "product_name": "Red Hat Ansible Engine 2.7 for RHEL 7", "release_date": "2019-10-24T00:00:00Z"}, {"advisory": "RHSA-2019:3203", "cpe": "cpe:/a:redhat:ansible_engine:2.8::el7", "impact": "moderate", "package": "ansible-0:2.8.6-1.el7ae", "product_name": "Red Hat Ansible Engine 2.8 for RHEL 7", "release_date": "2019-10-24T00:00:00Z"}, {"advisory": "RHSA-2019:3203", "cpe": "cpe:/a:redhat:ansible_engine:2.8::el8", "impact": "moderate", "package": "ansible-0:2.8.6-1.el8ae", "product_name": "Red Hat Ansible Engine 2.8 for RHEL 8", "release_date": "2019-10-24T00:00:00Z"}, {"advisory": "RHSA-2019:3207", "cpe": "cpe:/a:redhat:ansible_engine:2::el7", "impact": "moderate", "package": "ansible-0:2.8.6-1.el7ae", "product_name": "Red Hat Ansible Engine 2 for RHEL 7", "release_date": "2019-10-24T00:00:00Z"}, {"advisory": "RHSA-2019:3207", "cpe": "cpe:/a:redhat:ansible_engine:2::el8", "impact": "moderate", "package": "ansible-0:2.8.6-1.el8ae", "product_name": "Red Hat Ansible Engine 2 for RHEL 8", "release_date": "2019-10-24T00:00:00Z"}, {"advisory": "RHSA-2020:0756", "cpe": "cpe:/a:redhat:openstack:13::el7", "impact": "moderate", "package": "ansible-0:2.6.20-1.el7ae", "product_name": "Red Hat OpenStack Platform 13.0 (Queens)", "release_date": "2020-03-10T00:00:00Z"}, {"advisory": "RHSA-2020:0756", "cpe": "cpe:/a:redhat:openstack:13::el7", "impact": "moderate", "package": "ansible-0:2.6.20-1.el7ae", "product_name": "Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS", "release_date": "2020-03-10T00:00:00Z"}], "bugzilla": {"description": "ansible: sub parameters marked as no_log are not masked in certain failure scenarios", "id": "1760593", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1760593"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "status": "verified"}, "cwe": "CWE-117->CWE-532", "details": ["A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. When a module has an argument_spec with sub parameters marked as no_log, passing an invalid parameter name to the module will cause the task to fail before the no_log options in the sub parameters are processed. As a result, data in the sub parameter fields will not be masked and will be displayed if Ansible is run with increased verbosity and present in the module invocation arguments for the task.", "A flaw was found in ansible. When a module has an argument_spec with sub parameters marked as no_log, passing an invalid parameter name to the module will cause the task to fail before the no_log options in the sub parameters are processed. As a result, data in the sub parameter fields will not be masked and will be displayed if Ansible is run with increased verbosity and present in the module invocation arguments for the task."], "name": "CVE-2019-14858", "package_state": [{"cpe": "cpe:/a:redhat:cloudforms_managementengine:5", "fix_state": "Not affected", "package_name": "ansible", "product_name": "CloudForms Management Engine 5"}, {"cpe": "cpe:/a:redhat:ansible_tower:3", "fix_state": "Affected", "package_name": "ansible", "product_name": "Red Hat Ansible Tower 3"}, {"cpe": "cpe:/a:redhat:ceph_storage:2", "fix_state": "Out of support scope", "package_name": "ansible", "product_name": "Red Hat Ceph Storage 2"}, {"cpe": "cpe:/a:redhat:ceph_storage:3", "fix_state": "Affected", "package_name": "ansible", "product_name": "Red Hat Ceph Storage 3"}, {"cpe": "cpe:/a:redhat:openstack:10", "fix_state": "Will not fix", "impact": "moderate", "package_name": "ansible", "product_name": "Red Hat OpenStack Platform 10 (Newton)"}, {"cpe": "cpe:/a:redhat:openstack:14", "fix_state": "Out of support scope", "impact": "moderate", "package_name": "ansible", "product_name": "Red Hat OpenStack Platform 14 (Rocky)"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Out of support scope", "package_name": "ansible", "product_name": "Red Hat Satellite 6"}, {"cpe": "cpe:/a:redhat:storage:3", "fix_state": "Will not fix", "package_name": "ansible", "product_name": "Red Hat Storage 3"}], "public_date": "2019-10-11T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2019-14858\nhttps://nvd.nist.gov/vuln/detail/CVE-2019-14858"], "statement": "Fixes for Red Hat OpenStack Platform (RHOSP) have been set to 'Moderate' because flaw exploitation requires running Ansible with increased verbosity which is not the RHOSP deployment default.\nRed Hat Gluster Storage no longer maintains its own version of Ansible. The fix will be provided from core Ansible.", "threat_severity": "Moderate"}

{}