Skip to content
OpenAdvisories
High · 7.3 CVE-2019-14858 EUVD-2019-0005GHSA-h653-95qw-h2mpPYSEC-2019-171

Ansible leaks sensitive information to logs when told not to

Published Oct 14, 2019 · Updated Aug 5, 2024 · Assigned by redhat

Description

A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. When a module has an argument_spec with sub parameters marked as no_log, passing an invalid parameter name to the module will cause the task to fail before the no_log options in the sub parameters are processed. As a result, data in the sub parameter fields will not be masked and will be displayed if Ansible is run with increased verbosity and present in the module invocation arguments for the task.

Affected products

VendorProductAffectedFixed
Red Hat Ansible ansible_engine-2.x up to 2.8, ansible_tower-3.x up to 3.5 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 ansible 2.8.6+dfsg-1 —
Debian 13 ansible 2.8.6+dfsg-1 —
Debian 12 ansible 2.8.6+dfsg-1 —
ReleasePackageFixed inAdvisory
Ubuntu Pro 18.04 LTS ansible No fix yet —
ReleasePackageFixed inAdvisory
Red Hat OpenStack 13 ansible 2.6.20-1.el7ae RHSA-2020:0756
Red Hat Ansible Engine 2 ansible 2.6.20-1.el7ae RHSA-2019:3207, RHSA-2019:3203, RHSA-2019:3202
ReleasePackageFixed inAdvisory
SUSE Package Hub 15 SP1 ansible 2.9.6-bp151.3.6.1 openSUSE-SU-2020:0523-1
SUSE OpenStack Cloud Crowbar 8 ansible 2.9.14-3.15.1 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud Crowbar 8 crowbar-core 5.0+git.1600432272.b3ad722f0-3.44.1 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud Crowbar 8 crowbar-openstack 5.0+git.1599037158.5c4d07480-4.43.1 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud Crowbar 8 documentation-suse-openstack-cloud-deployment +3 8.20201007-1.29.1 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud Crowbar 8 grafana 6.7.4-4.12.1 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud Crowbar 8 grafana-natel-discrete-panel 0.0.9-3.3.6 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud Crowbar 8 openstack-cinder 11.2.3~dev29-3.28.2 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud Crowbar 8 openstack-cinder-doc 11.2.3~dev29-3.28.1 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud Crowbar 8 openstack-monasca-installer 20190923_16.32-3.15.1 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud Crowbar 8 openstack-neutron 11.0.9~dev69-3.37.2 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud Crowbar 8 openstack-neutron-doc 11.0.9~dev69-3.37.1 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud Crowbar 8 openstack-nova 16.1.9~dev76-3.39.2 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud Crowbar 8 openstack-nova-doc 16.1.9~dev76-3.39.1 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud Crowbar 8 python-Django 1.11.29-3.19.2 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud Crowbar 8 python-Pillow 4.2.1-3.9.2 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud Crowbar 8 python-keystoneclient 3.13.1-3.3.2 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud Crowbar 8 python-keystonemiddleware 4.17.1-5.3.1 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud Crowbar 8 python-kombu 4.1.0-3.7.1 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud Crowbar 8 python-straight-plugin 1.5.0-1.3.1 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud Crowbar 8 python-urllib3 1.22-5.12.1 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud Crowbar 8 release-notes-suse-openstack-cloud 8.20200922-3.23.1 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud Crowbar 8 rubygem-crowbar-client 3.9.3-1.1 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud Crowbar 8 storm 1.2.3-3.6.1 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud 8 ansible 2.9.14-3.15.1 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud 8 ardana-ansible 8.0+git.1596735237.54109b1-3.77.1 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud 8 ardana-cinder 8.0+git.1596129856.263f430-3.43.1 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud 8 ardana-glance 8.0+git.1593631779.76fa9b7-3.24.1 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud 8 ardana-mq 8.0+git.1593618123.678c32b-3.26.1 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud 8 ardana-nova 8.0+git.1601298847.dd01585-3.42.1 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud 8 ardana-osconfig 8.0+git.1595885113.93abcbc-3.49.1 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud 8 documentation-suse-openstack-cloud-user +8 8.20201007-1.29.1 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud 8 grafana 6.7.4-4.12.1 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud 8 grafana-natel-discrete-panel 0.0.9-3.3.6 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud 8 openstack-cinder 11.2.3~dev29-3.28.2 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud 8 openstack-cinder-doc 11.2.3~dev29-3.28.1 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud 8 openstack-monasca-installer 20190923_16.32-3.15.1 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud 8 openstack-neutron 11.0.9~dev69-3.37.2 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud 8 openstack-neutron-doc 11.0.9~dev69-3.37.1 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud 8 openstack-nova 16.1.9~dev76-3.39.2 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud 8 openstack-nova-doc 16.1.9~dev76-3.39.1 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud 8 python-Django 1.11.29-3.19.2 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud 8 python-Flask-Cors 3.0.3-3.3.1 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud 8 python-Pillow 4.2.1-3.9.2 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud 8 python-ardana-packager 0.0.3-7.7.2 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud 8 python-keystoneclient 3.13.1-3.3.2 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud 8 python-keystonemiddleware 4.17.1-5.3.1 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud 8 python-kombu 4.1.0-3.7.1 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud 8 python-straight-plugin 1.5.0-1.3.1 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud 8 python-urllib3 1.22-5.12.1 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud 8 release-notes-suse-openstack-cloud 8.20200922-3.23.1 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud 8 storm 1.2.3-3.6.1 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud 8 venv-openstack-aodh 5.1.1~dev7-12.28.1 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud 8 venv-openstack-barbican 5.0.2~dev3-12.29.1 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud 8 venv-openstack-ceilometer 9.0.8~dev7-12.26.1 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud 8 venv-openstack-cinder 11.2.3~dev29-14.30.1 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud 8 venv-openstack-designate 5.0.3~dev7-12.27.1 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud 8 venv-openstack-freezer 5.0.0.0~xrc2~dev2-10.24.1 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud 8 venv-openstack-glance 15.0.3~dev3-12.27.1 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud 8 venv-openstack-heat 9.0.8~dev22-12.29.1 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud 8 venv-openstack-horizon 12.0.5~dev3-14.32.1 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud 8 venv-openstack-ironic 9.1.8~dev8-12.29.1 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud 8 venv-openstack-keystone 12.0.4~dev11-11.30.1 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud 8 venv-openstack-magnum 5.0.2_5.0.2_5.0.2~dev31-11.28.1 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud 8 venv-openstack-manila 5.1.1~dev5-12.33.1 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud 8 venv-openstack-monasca 2.2.2~dev1-11.24.1 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud 8 venv-openstack-monasca-ceilometer 1.5.1_1.5.1_1.5.1~dev3-8.24.1 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud 8 venv-openstack-murano 4.0.2~dev2-12.24.1 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud 8 venv-openstack-neutron 11.0.9~dev69-13.32.1 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud 8 venv-openstack-nova 16.1.9~dev76-11.30.1 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud 8 venv-openstack-octavia 1.0.6~dev3-12.29.1 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud 8 venv-openstack-sahara 7.0.5~dev4-11.28.1 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud 8 venv-openstack-swift 2.15.2_2.15.2_2.15.2~dev32-11.21.1 SUSE-SU-2020:3309-1
SUSE OpenStack Cloud 8 venv-openstack-trove 8.0.2~dev2-11.28.1 SUSE-SU-2020:3309-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SUSE HPE Helion OpenStack 8 ansible 2.9.14-3.15.1 SUSE-SU-2020:3309-1
SUSE HPE Helion OpenStack 8 ardana-ansible 8.0+git.1596735237.54109b1-3.77.1 SUSE-SU-2020:3309-1
SUSE HPE Helion OpenStack 8 ardana-cinder 8.0+git.1596129856.263f430-3.43.1 SUSE-SU-2020:3309-1
SUSE HPE Helion OpenStack 8 ardana-glance 8.0+git.1593631779.76fa9b7-3.24.1 SUSE-SU-2020:3309-1
SUSE HPE Helion OpenStack 8 ardana-mq 8.0+git.1593618123.678c32b-3.26.1 SUSE-SU-2020:3309-1
SUSE HPE Helion OpenStack 8 ardana-nova 8.0+git.1601298847.dd01585-3.42.1 SUSE-SU-2020:3309-1
SUSE HPE Helion OpenStack 8 ardana-osconfig 8.0+git.1595885113.93abcbc-3.49.1 SUSE-SU-2020:3309-1
SUSE HPE Helion OpenStack 8 documentation-hpe-helion-openstack-user +5 8.20201007-1.29.1 SUSE-SU-2020:3309-1
SUSE HPE Helion OpenStack 8 grafana 6.7.4-4.12.1 SUSE-SU-2020:3309-1
SUSE HPE Helion OpenStack 8 grafana-natel-discrete-panel 0.0.9-3.3.6 SUSE-SU-2020:3309-1
SUSE HPE Helion OpenStack 8 openstack-cinder 11.2.3~dev29-3.28.2 SUSE-SU-2020:3309-1
SUSE HPE Helion OpenStack 8 openstack-cinder-doc 11.2.3~dev29-3.28.1 SUSE-SU-2020:3309-1
SUSE HPE Helion OpenStack 8 openstack-monasca-installer 20190923_16.32-3.15.1 SUSE-SU-2020:3309-1
SUSE HPE Helion OpenStack 8 openstack-neutron 11.0.9~dev69-3.37.2 SUSE-SU-2020:3309-1
SUSE HPE Helion OpenStack 8 openstack-neutron-doc 11.0.9~dev69-3.37.1 SUSE-SU-2020:3309-1
SUSE HPE Helion OpenStack 8 openstack-nova 16.1.9~dev76-3.39.2 SUSE-SU-2020:3309-1
SUSE HPE Helion OpenStack 8 openstack-nova-doc 16.1.9~dev76-3.39.1 SUSE-SU-2020:3309-1
SUSE HPE Helion OpenStack 8 python-Django 1.11.29-3.19.2 SUSE-SU-2020:3309-1
SUSE HPE Helion OpenStack 8 python-Flask-Cors 3.0.3-3.3.1 SUSE-SU-2020:3309-1
SUSE HPE Helion OpenStack 8 python-Pillow 4.2.1-3.9.2 SUSE-SU-2020:3309-1
SUSE HPE Helion OpenStack 8 python-ardana-packager 0.0.3-7.7.2 SUSE-SU-2020:3309-1
SUSE HPE Helion OpenStack 8 python-keystoneclient 3.13.1-3.3.2 SUSE-SU-2020:3309-1
SUSE HPE Helion OpenStack 8 python-keystonemiddleware 4.17.1-5.3.1 SUSE-SU-2020:3309-1
SUSE HPE Helion OpenStack 8 python-kombu 4.1.0-3.7.1 SUSE-SU-2020:3309-1
SUSE HPE Helion OpenStack 8 python-urllib3 1.22-5.12.1 SUSE-SU-2020:3309-1
SUSE HPE Helion OpenStack 8 release-notes-hpe-helion-openstack 8.20200922-3.23.1 SUSE-SU-2020:3309-1
SUSE HPE Helion OpenStack 8 storm 1.2.3-3.6.1 SUSE-SU-2020:3309-1
SUSE HPE Helion OpenStack 8 venv-openstack-aodh 5.1.1~dev7-12.28.1 SUSE-SU-2020:3309-1
SUSE HPE Helion OpenStack 8 venv-openstack-barbican 5.0.2~dev3-12.29.1 SUSE-SU-2020:3309-1
SUSE HPE Helion OpenStack 8 venv-openstack-ceilometer 9.0.8~dev7-12.26.1 SUSE-SU-2020:3309-1
SUSE HPE Helion OpenStack 8 venv-openstack-cinder 11.2.3~dev29-14.30.1 SUSE-SU-2020:3309-1
SUSE HPE Helion OpenStack 8 venv-openstack-designate 5.0.3~dev7-12.27.1 SUSE-SU-2020:3309-1
SUSE HPE Helion OpenStack 8 venv-openstack-freezer 5.0.0.0~xrc2~dev2-10.24.1 SUSE-SU-2020:3309-1
SUSE HPE Helion OpenStack 8 venv-openstack-glance 15.0.3~dev3-12.27.1 SUSE-SU-2020:3309-1
SUSE HPE Helion OpenStack 8 venv-openstack-heat 9.0.8~dev22-12.29.1 SUSE-SU-2020:3309-1
SUSE HPE Helion OpenStack 8 venv-openstack-horizon-hpe 12.0.5~dev3-14.32.1 SUSE-SU-2020:3309-1
SUSE HPE Helion OpenStack 8 venv-openstack-ironic 9.1.8~dev8-12.29.1 SUSE-SU-2020:3309-1
SUSE HPE Helion OpenStack 8 venv-openstack-keystone 12.0.4~dev11-11.30.1 SUSE-SU-2020:3309-1
SUSE HPE Helion OpenStack 8 venv-openstack-magnum 5.0.2_5.0.2_5.0.2~dev31-11.28.1 SUSE-SU-2020:3309-1
SUSE HPE Helion OpenStack 8 venv-openstack-manila 5.1.1~dev5-12.33.1 SUSE-SU-2020:3309-1
SUSE HPE Helion OpenStack 8 venv-openstack-monasca 2.2.2~dev1-11.24.1 SUSE-SU-2020:3309-1
SUSE HPE Helion OpenStack 8 venv-openstack-monasca-ceilometer 1.5.1_1.5.1_1.5.1~dev3-8.24.1 SUSE-SU-2020:3309-1
SUSE HPE Helion OpenStack 8 venv-openstack-murano 4.0.2~dev2-12.24.1 SUSE-SU-2020:3309-1
SUSE HPE Helion OpenStack 8 venv-openstack-neutron 11.0.9~dev69-13.32.1 SUSE-SU-2020:3309-1
SUSE HPE Helion OpenStack 8 venv-openstack-nova 16.1.9~dev76-11.30.1 SUSE-SU-2020:3309-1
SUSE HPE Helion OpenStack 8 venv-openstack-octavia 1.0.6~dev3-12.29.1 SUSE-SU-2020:3309-1
SUSE HPE Helion OpenStack 8 venv-openstack-sahara 7.0.5~dev4-11.28.1 SUSE-SU-2020:3309-1
SUSE HPE Helion OpenStack 8 venv-openstack-swift 2.15.2_2.15.2_2.15.2~dev32-11.21.1 SUSE-SU-2020:3309-1
SUSE HPE Helion OpenStack 8 venv-openstack-trove 8.0.2~dev2-11.28.1 SUSE-SU-2020:3309-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed ansible-10 10.6.0-1.1 openSUSE-SU-2024:14536-1
openSUSE Tumbleweed ansible-11 11.11.0-1.1 openSUSE-SU-2025:15605-1
openSUSE Tumbleweed ansible-12 12.2.0-1.1 openSUSE-SU-2025:15753-1
openSUSE Tumbleweed ansible-13 13.7.0-1.1 openSUSE-SU-2026:10944-1
openSUSE Tumbleweed ansible-14 14.6.0-1.1 openSUSE-SU-2026:12447-1
openSUSE Tumbleweed ansible-9 9.8.0-1.1 openSUSE-SU-2024:14244-1
openSUSE Leap 15.1 ansible 2.9.6-lp151.2.7.1 openSUSE-SU-2020:0513-1
ReleasePackageFixed inAdvisory
Alpine v3.15 ansible-base 2.8.6-r0 —
Alpine v3.14 ansible-base 2.8.6-r0 —
Alpine v3.13 ansible-base 2.8.6-r0 —
Alpine v3.12 ansible 2.8.6-r0 —
Alpine v3.11 ansible 2.8.6-r0 —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.10 ansible 2.8.6-r0 —
Alpine v3.9 ansible 2.7.14-r0 —
Alpine v3.8 ansible 2.6.20-r0 —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI ansible >= 2.9.0a1, < 2.9.0rc4 2.9.0rc4 GHSA-h653-95qw-h2mp
PyPI ansible >= 2.8.0a1, < 2.8.6 2.8.6 GHSA-h653-95qw-h2mp
PyPI ansible >= 2.7.0a1, < 2.7.14 2.7.14 GHSA-h653-95qw-h2mp
PyPI ansible >= 2.0, < 2.6.20 2.6.20 GHSA-h653-95qw-h2mp
PyPI ansible >= 2.0, < 2.8.1 2.8.1 PYSEC-2019-171

Advisories 15

References