Skip to content
OpenAdvisories
High RHSA-2019:3207 3 CVEs

Red Hat Security Advisory: Ansible security and bug fix update

Published Sep 13, 2024 · Updated Jun 29, 2026

Ecosystem: Red Hat

Fixed packages 2

ReleasePackageFixed in
Red Hat · Ansible Engine 2 ansible_engine:2::el7 ansible 0:2.8.6-1.el7ae
Red Hat · Ansible Engine 2 ansible_engine:2::el8 ansible 0:2.8.6-1.el8ae

Vulnerabilities 3

  • High 7.3
    CVE-2019-14846

    Ansible Uses Plugins That Disclose Credentials

    In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG level which lead to a disclosure of credentials if a plugin used a library that logged credentials at the DEBUG level. …

    Red Hat Ansible ansible ansible Debian Ubuntu Alpine PyPI
  • High 7.3
    CVE-2019-14858

    Ansible leaks sensitive information to logs when told not to

    A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. When a module has an argument_spec with sub parameters marked as no_log, passing an invalid parameter name to the module will cause the task to fail before the no_log o…

    Red Hat Ansible ansible ansible Debian Ubuntu Alpine PyPI
  • Medium 6.4
    CVE-2019-14856

    Ansible password prompts could expose passwords

    ansible before versions 2.8.6, 2.7.14, 2.6.20 is vulnerable to a None

    [UNKNOWN] ansible ansible ansible Alpine PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1755373
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1760593
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1760829
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3207.json
  • report
    https://access.redhat.com/security/cve/CVE-2019-14846
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-14846
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-14846
  • report
    https://access.redhat.com/security/cve/CVE-2019-14856
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-14856
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-14856
  • report
    https://access.redhat.com/security/cve/CVE-2019-14858
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-14858
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-14858