Skip to content
OpenAdvisories
Medium RHSA-2019:3789 3 CVEs

Red Hat Security Advisory: ansible security update

Published Sep 13, 2024 · Updated Jun 29, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · OpenStack 13 openstack:13::el7 ansible 0:2.6.19-1.el7ae

Vulnerabilities 3

  • Medium 6.4
    CVE-2019-10206

    Ansible password prompts could expose passwords

    ansible-playbook -k and ansible cli tools, all versions 2.8.x before 2.8.4, all 2.7.x before 2.7.13 and all 2.6.x before 2.6.19, prompt passwords by expanding them from templates as they could contain special characters. Passwords should be wrapped to prevent…

    Red Hat Ansible ansible ansible Debian Ubuntu Alpine PyPI
  • Medium 4.6
    CVE-2019-10156

    Exposure of Sensitive Information to an Unauthorized Actor in ansible

    A flaw was discovered in the way Ansible templating was implemented in versions before 2.6.18, 2.7.12 and 2.8.2, causing the possibility of information disclosure through unexpected variable substitution. By taking advantage of unintended variable substitutio…

    Red Hat Ansible ansible ansible Debian Ubuntu Alpine PyPI
  • Medium 4.2
    CVE-2019-3828

    Ansible Path Traversal vulnerability

    Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files outside of the specified destination in the local ansible controller host, by not restricting an absolute path.

    Red Hat Ansible ansible ansible Debian Ubuntu Alpine PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1676689
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1717311
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1732623
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3789.json
  • report
    https://access.redhat.com/security/cve/CVE-2019-3828
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-3828
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-3828
  • article
    https://github.com/ansible/ansible/pull/52133
  • report
    https://access.redhat.com/security/cve/CVE-2019-10156
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-10156
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-10156
  • report
    https://access.redhat.com/security/cve/CVE-2019-10206
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-10206
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-10206
  • article
    https://github.com/ansible/ansible/pull/59246