Read the docs
Red Hat Security Advisory

RHSA-2019:3789

ansible security update

Released 2019-11-07 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Fixes 3 records

TI-2019-07526 CVE-2019-10206 · GHSA-cqmr-rcpr-cxh3

Insufficiently protected credentials in Red Hat Ansible

Priority LOW 32

ansible-playbook -k and ansible cli tools, all versions 2.8.x before 2.8.4, all 2.7.x before 2.7.13 and all 2.6.x before 2.6.19, prompt passwords by expanding them from templates as they could contain special characters.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01503 Published 2019-11-22 Partial fix · 2.8.4, 2.7.13 +1 CWE-522
TI-2019-07477 CVE-2019-10156 · GHSA-grgm-pph5-j5h7

Information disclosure in Red Hat ansible

Priority LOW 28

A flaw was discovered in the way Ansible templating was implemented in versions before 2.6.18, 2.7.12 and 2.8.2, causing the possibility of information disclosure through unexpected variable substitution.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.01759 Published 2019-07-30 Partial fix · 2.6.18, 2.7.12 +1 CWE-200
TI-2019-02840 CVE-2019-3828 · GHSA-74vq-h4q8-x6jv

Path traversal in Red Hat Ansible

Priority LOW 20

Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files outside of the specified destination in the local ansible controller host, by not r…

CVSS 3.1MEDIUM 4.2 Local High privileges User interaction EPSS 0.00522 Published 2019-03-27 Partial fix · 2.5.15, 2.6.14 +1 CWE-22