Read the docs
TI-2019-07537 Aliases CVE-2019-10217GHSA-p75j-wc34-527c

Information disclosure in Red Hat Ansible

Priority LOW 33CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.

Summary

A flaw was found in ansible 2.8.0 before 2.8.4. Fields managing sensitive data should be set as such by no_log feature. Some of these fields in GCP modules are not set properly. service_account_contents() which is common class for all gcp modules is not setting no_log to True. Any sensitive data managed by that function would be leak as an output when running ansible playbooks.

Why it matters now

EPSS 0.01853 79th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed ansible (PyPI): 2.8.4Red Hat: 2 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatAnsibleansible 2.8.0 before 2.8.4—No fix listedCNA
—ansible (PyPI)2.8.0a1 to before 2.8.42.8.4Patch availableGHSA-p75j-wc34-527c
  • Ansible VendorRed Hat Affected ansible 2.8.0 before 2.8.4 Fixed in — No fix listed CNA
  • ansible (PyPI) Vendor— Affected 2.8.0a1 to before 2.8.4 Fixed in 2.8.4 Patch available GHSA-p75j-wc34-527c

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*2.8.0 to before 2.8.4VulnerableRed Hat
  • cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:* Versions 2.8.0 to before 2.8.4 Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-p75j-wc34-527c ansible (PyPI) Fixed in 2.8.4 Advisory →

Red Hat 2 advisories

  • RHSA-2019:2542 Released 2019-08-21 · Red Hat rating Moderate
    Ansible security and bug fix update
    • Red Hat Ansible Engine 2.8 for RHEL 7 Server ansible-2.8.4-1.el7ae
    • Red Hat Ansible Engine 2.8 for RHEL 8 ansible-2.8.4-1.el8ae
  • RHSA-2019:2543 Released 2019-08-21 · Red Hat rating Moderate
    Ansible security and bug fix update
    • Red Hat Ansible Engine 2 for RHEL 7 ansible-2.8.4-1.el7ae
    • Red Hat Ansible Engine 2 for RHEL 8 ansible-2.8.4-1.el8ae

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ansible Engine 2 for RHEL 7Fixed RHSA-2019:2543
Red Hat Ansible Engine 2 for RHEL 8Fixed RHSA-2019:2543
Red Hat Ansible Engine 2.8 for RHEL 7 ServerFixed RHSA-2019:2542
Red Hat Ansible Engine 2.8 for RHEL 8Fixed RHSA-2019:2542
Not affected: 5 products
  • Red Hat Ceph Storage 2
  • Red Hat Ceph Storage 3
  • Red Hat OpenStack Platform 10 (Newton)
  • Red Hat OpenStack Platform 13 (Queens)
  • Red Hat OpenStack Platform 14 (Rocky)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-10217
  2. 2026-10-03 Alias added: GHSA-p75j-wc34-527c

References

Exploit 1

Advisory 6

Other 3

  • TI-2016-07808 Improper input validation in Ansible CVSS 3.1HIGH 8.1
  • TI-2014-03853 Injection in Ansible CVSS 3.1CRITICAL 9.8
  • TI-2014-03839 The safe_eval function in Ansible before 1.5.4 does not properly restrict the code… CVSS 3.1CRITICAL 9.8
  • TI-2017-05191 Sensitive information in log files in Red Hat ansible CVSS 3.1CRITICAL 9.8
  • TI-2014-04077 Multiple argument injection vulnerabilities in Ansible before 1.6.7 allow remote… CVSS 3.1CRITICAL 9.8
  • TI-2014-04076 Ansible before 1.6.7 does not prevent inventory data with "{{" and "lookup" substrings… CVSS 3.1CRITICAL 9.8
See all 44 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences