Information disclosure in Red Hat ansible
Priority LOW 28CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Partial Red Hat: 8 fixed, 13 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.
Summary
A flaw was discovered in the way Ansible templating was implemented in versions before 2.6.18, 2.7.12 and 2.8.2, causing the possibility of information disclosure through unexpected variable substitution. By taking advantage of unintended variable substitution the content of any variable may be disclosed.
Why it matters now
EPSS 0.01759 78th percentileScored 2026-11-07
Fix Partial ansible (PyPI): 2.6.18, 2.7.12, 2.8.2Red Hat: 6 advisoriesRed Hat: 8 fixed, 13 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | ansible | fixed in 2.6.18; fixed in 2.7.12; fixed in 2.8.2 | — | No fix listed | CNA |
| — | ansible (PyPI) | before 2.6.18 | 2.6.18 | Patch available | GHSA-grgm-pph5-j5h7 |
| — | ansible (PyPI) | 2.7.0a1 to before 2.7.12 | 2.7.12 | Patch available | GHSA-grgm-pph5-j5h7 |
| — | ansible (PyPI) | 2.8.0a1 to before 2.8.2 | 2.8.2 | Patch available | GHSA-grgm-pph5-j5h7 |
- ansible VendorRed Hat Affected fixed in 2.6.18; fixed in 2.7.12; fixed in 2.8.2 Fixed in — No fix listed CNA
- ansible (PyPI) Vendor— Affected before 2.6.18 Fixed in 2.6.18 Patch available GHSA-grgm-pph5-j5h7
- ansible (PyPI) Vendor— Affected 2.7.0a1 to before 2.7.12 Fixed in 2.7.12 Patch available GHSA-grgm-pph5-j5h7
- ansible (PyPI) Vendor— Affected 2.8.0a1 to before 2.8.2 Fixed in 2.8.2 Patch available GHSA-grgm-pph5-j5h7
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:* | before 2.6.18; 2.7.0 to before 2.7.12; 2.8.0 to before 2.8.2 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:* | 13 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openstack:14:*:*:*:*:*:*:* | 14 | Vulnerable | Red Hat |
| cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
- cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:* Versions before 2.6.18; 2.7.0 to before 2.7.12; 2.8.0 to before 2.8.2 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:* Versions 13 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openstack:14:*:*:*:*:*:*:* Versions 14 Vulnerable ·Red Hat
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
Remediation
- Fix · GHSA-grgm-pph5-j5h7 ansible (PyPI) Fixed in 2.6.18 Advisory →
- Fix · GHSA-grgm-pph5-j5h7 ansible (PyPI) Fixed in 2.7.12 Advisory →
- Fix · GHSA-grgm-pph5-j5h7 ansible (PyPI) Fixed in 2.8.2 Advisory →
Red Hat 6 advisories
- RHSA-2019:3789 Released 2019-11-07 · Red Hat rating Moderateansible security update
- Red Hat OpenStack Platform 13.0 ansible-2.6.19-1.el7ae
- RHSA-2019:3744 Released 2019-11-06 · Red Hat rating Moderateansible security update
- Red Hat OpenStack Platform 14.0 ansible-2.6.19-1.el7ae
- RHSA-2019:1707 Released 2019-07-09 · Red Hat rating Moderateansible security and bug fix update
- Red Hat Ansible Engine 2.6 for RHEL 7 Server ansible-2.6.18-1.el7ae
Show 3 more Red Hat advisories
- RHSA-2019:1708 Released 2019-07-09 · Red Hat rating Moderateansible security and bug fix update
- Red Hat Ansible Engine 2.8 for RHEL 7 Server ansible-2.8.2-1.el7ae
- Red Hat Ansible Engine 2.8 for RHEL 8 ansible-2.8.2-1.el8ae
- RHSA-2019:1706 Released 2019-07-09 · Red Hat rating Moderateansible security and bug fix update
- Red Hat Ansible Engine 2 for RHEL 7 ansible-2.8.2-1.el7ae
- Red Hat Ansible Engine 2 for RHEL 8 ansible-2.8.2-1.el8ae
- RHSA-2019:1705 Released 2019-07-09 · Red Hat rating Moderateansible security and bug fix update
- Red Hat Ansible Engine 2.7 for RHEL 7 Server ansible-2.7.12-1.el7ae
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| CloudForms Management Engine 5 | Affected | No fix planned: Out of support scope |
| Red Hat Ansible Tower 3 | Affected | No fix yet |
| Red Hat Ceph Storage 2 | Affected | No fix planned: Will not fix |
| Red Hat Ceph Storage 3 | Affected | No fix yet |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 3.2 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 3.3 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 3.4 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 3.5 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 3.6 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 3.7 | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 10 (Newton) | Affected | No fix planned: Will not fix |
| Red Hat Storage 3 | Affected | No fix planned: Will not fix |
| Red Hat Ansible Engine 2 for RHEL 7 | Fixed | RHSA-2019:1706 |
| Red Hat Ansible Engine 2 for RHEL 8 | Fixed | RHSA-2019:1706 |
| Red Hat Ansible Engine 2.6 for RHEL 7 Server | Fixed | RHSA-2019:1707 |
| Red Hat Ansible Engine 2.7 for RHEL 7 Server | Fixed | RHSA-2019:1705 |
| Red Hat Ansible Engine 2.8 for RHEL 7 Server | Fixed | RHSA-2019:1708 |
| Red Hat Ansible Engine 2.8 for RHEL 8 | Fixed | RHSA-2019:1708 |
| Red Hat OpenStack Platform 13.0 | Fixed | RHSA-2019:3789 |
| Red Hat OpenStack Platform 14.0 | Fixed | RHSA-2019:3744 |
Timeline
- 2026-10-02 Threatist record created from CVE-2019-10156
- 2026-10-03 Alias added: GHSA-grgm-pph5-j5h7
References
Advisory 8
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10156
- [debian-lts-announce] 20190916 [SECURITY] [DLA 1923-1] ansible security update
- RHSA-2019:3744
- RHSA-2019:3789
- [debian-lts-announce] 20210127 [SECURITY] [DLA 2535-1] ansible security update
- DSA-4950
- https://nvd.nist.gov/vuln/detail/CVE-2019-10156
- https://github.com/advisories/GHSA-grgm-pph5-j5h7
Other 5
- https://github.com/ansible/ansible/commit/04e94274fb92e116e9082cc9b86b1fd05c836922
- https://github.com/ansible/ansible/commit/3ff6505e8ff0e4655bab008886983476ef903375
- https://github.com/ansible/ansible/commit/a11c3edfa41e7e4a4db323cdabfc2eae1b61da2a
- https://github.com/ansible/ansible
- https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2019-2.yaml
More Red Hat Ansible vulnerabilities
- TI-2016-07808 Improper input validation in Ansible CVSS 3.1HIGH 8.1
- TI-2014-03853 Injection in Ansible CVSS 3.1CRITICAL 9.8
- TI-2014-03839 The safe_eval function in Ansible before 1.5.4 does not properly restrict the code… CVSS 3.1CRITICAL 9.8
- TI-2017-05191 Sensitive information in log files in Red Hat ansible CVSS 3.1CRITICAL 9.8
- TI-2014-04077 Multiple argument injection vulnerabilities in Ansible before 1.6.7 allow remote… CVSS 3.1CRITICAL 9.8
- TI-2014-04076 Ansible before 1.6.7 does not prevent inventory data with "{{" and "lookup" substrings… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2019-10156 · CVE Program
- CVE-2019-10156 · NVD
- FIRST EPSS
- GHSA-grgm-pph5-j5h7 · GitHub Advisory Database · CC BY 4.0
- CVE-2019-10156 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences