Read the docs
TI-2019-11051 Aliases CVE-2019-14846GHSA-pm48-cvv2-29q5

Sensitive information in log files in Red Hat Ansible

Priority LOW 35CWE-117Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 8 fixed, 6 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-532.

Summary

In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG level which lead to a disclosure of credentials if a plugin used a library that logged credentials at the DEBUG level. This flaw does not affect Ansible modules, as those are executed in a separate process.

Why it matters now

EPSS 0.00509 43rd percentileScored 2026-11-07
Fix Partial ansible (PyPI): 2.6.20, 2.7.14, 2.8.6Red Hat: 5 advisoriesRed Hat: 8 fixed, 6 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatAnsibleall ansible_engine-2.x and ansible_engine-3.x up to ansible_engine-3.5—No fix listedCNA
—ansible (PyPI)before 2.6.202.6.20Patch availableGHSA-pm48-cvv2-29q5
—ansible (PyPI)2.7.0a1 to before 2.7.142.7.14Patch availableGHSA-pm48-cvv2-29q5
—ansible (PyPI)2.8.0a1 to before 2.8.62.8.6Patch availableGHSA-pm48-cvv2-29q5
  • Ansible VendorRed Hat Affected all ansible_engine-2.x and ansible_engine-3.x up to ansible_engine-3.5 Fixed in — No fix listed CNA
  • ansible (PyPI) Vendor— Affected before 2.6.20 Fixed in 2.6.20 Patch available GHSA-pm48-cvv2-29q5
  • ansible (PyPI) Vendor— Affected 2.7.0a1 to before 2.7.14 Fixed in 2.7.14 Patch available GHSA-pm48-cvv2-29q5
  • ansible (PyPI) Vendor— Affected 2.8.0a1 to before 2.8.6 Fixed in 2.8.6 Patch available GHSA-pm48-cvv2-29q5

CPE configurations NVD · 11

CPEVersionsRoleVendor
cpe:2.3:a:redhat:ansible_engine:*:*:*:*:*:*:*:*before 2.6.20; 2.7.0 to before 2.7.14; 2.8.0 to before 2.8.6VulnerableRed Hat
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*8.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*15.0 sp1VulnerableopenSUSE
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*15.1VulnerableopenSUSE
cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:*13VulnerableRed Hat
cpe:2.3:a:redhat:ansible_engine:2.0:*:*:*:*:*:*:*2.0VulnerableRed Hat
cpe:2.3:a:redhat:ansible_engine:2.8.0:*:*:*:*:*:*:*2.8.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*7.0Running onRed Hat
  • cpe:2.3:a:redhat:ansible_engine:*:*:*:*:*:*:*:* Versions before 2.6.20; 2.7.0 to before 2.7.14; 2.8.0 to before 2.8.6 Vulnerable ·Red Hat
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:* Versions 15.0 sp1 Vulnerable ·openSUSE
  • cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
  • cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:* Versions 13 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:ansible_engine:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:ansible_engine:2.8.0:*:*:*:*:*:*:* Versions 2.8.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* Versions 7.0 Running on ·Red Hat
Show 1 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:redhat:enterprise_linux_server:8.0:*:*:*:*:*:*:*8.0Running onRed Hat
  • cpe:2.3:o:redhat:enterprise_linux_server:8.0:*:*:*:*:*:*:* Versions 8.0 Running on ·Red Hat

Remediation

  • Fix · GHSA-pm48-cvv2-29q5 ansible (PyPI) Fixed in 2.6.20 Advisory →
  • Fix · GHSA-pm48-cvv2-29q5 ansible (PyPI) Fixed in 2.7.14 Advisory →
  • Fix · GHSA-pm48-cvv2-29q5 ansible (PyPI) Fixed in 2.8.6 Advisory →

Red Hat 5 advisories

  • RHSA-2020:0756 Released 2020-03-10 · Red Hat rating Moderate
    ansible security update
    • Red Hat OpenStack Platform 13.0 ansible-2.6.20-1.el7ae
    • Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS Server ansible-2.6.20-1.el7ae
  • RHSA-2019:3201 Released 2019-10-24 · Red Hat rating Important
    Ansible security update
    • Red Hat Ansible Engine 2.6 for RHEL 7 Server ansible-2.6.20-1.el7ae
  • RHSA-2019:3203 Released 2019-10-24 · Red Hat rating Important
    Ansible security and bug fix update
    • Red Hat Ansible Engine 2.8 for RHEL 7 Server ansible-2.8.6-1.el7ae
    • Red Hat Ansible Engine 2.8 for RHEL 8 ansible-2.8.6-1.el8ae
Show 2 more Red Hat advisories
  • RHSA-2019:3207 Released 2019-10-24 · Red Hat rating Important
    Ansible security and bug fix update
    • Red Hat Ansible Engine 2 for RHEL 7 ansible-2.8.6-1.el7ae
    • Red Hat Ansible Engine 2 for RHEL 8 ansible-2.8.6-1.el8ae
  • RHSA-2019:3202 Released 2019-10-24 · Red Hat rating Important
    Ansible security and bug fix update
    • Red Hat Ansible Engine 2.7 for RHEL 7 Server ansible-2.7.14-1.el7ae

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Red Hat Ansible — RHSA-2019:3201

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2019-11062 Sensitive information in log files in Red Hat AnsiblePriority LOW 25
    Show all 2 records → Advisory →
  • Advisory ·

    Red Hat Ansible — RHSA-2019:3202

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2019-11062 Sensitive information in log files in Red Hat AnsiblePriority LOW 25
    Show all 2 records → Advisory →
Show 2 more groups
  • Advisory ·

    Red Hat Ansible — RHSA-2019:3203

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2019-11062 Sensitive information in log files in Red Hat AnsiblePriority LOW 25
    Show all 2 records → Advisory →
  • Advisory ·

    Red Hat Ansible — RHSA-2019:3207

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2019-11062 Sensitive information in log files in Red Hat AnsiblePriority LOW 25
    Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ansible Tower 3AffectedNo fix yet
Red Hat Ceph Storage 2AffectedNo fix planned: Out of support scope
Red Hat Ceph Storage 3AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 10 (Newton)AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 14 (Rocky)AffectedNo fix planned: Out of support scope
Red Hat Storage 3AffectedNo fix planned: Will not fix
Red Hat Ansible Engine 2 for RHEL 7Fixed RHSA-2019:3207
Red Hat Ansible Engine 2 for RHEL 8Fixed RHSA-2019:3207
Red Hat Ansible Engine 2.6 for RHEL 7 ServerFixed RHSA-2019:3201
Red Hat Ansible Engine 2.7 for RHEL 7 ServerFixed RHSA-2019:3202
Red Hat Ansible Engine 2.8 for RHEL 7 ServerFixed RHSA-2019:3203
Red Hat Ansible Engine 2.8 for RHEL 8Fixed RHSA-2019:3203
Red Hat OpenStack Platform 13.0Fixed RHSA-2020:0756
Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS ServerFixed RHSA-2020:0756
Not affected: 2 products
  • CloudForms Management Engine 5
  • Red Hat Satellite 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-14846
  2. 2026-10-03 Alias added: GHSA-pm48-cvv2-29q5

References

Patch 1

Advisory 12

Other 5

  • TI-2018-05593 transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before… CVSS 3.1CRITICAL 9.8
  • TI-2017-05127 Improper input validation in [UNKNOWN] ansible CVSS 3.1CRITICAL 9.8
  • TI-2021-03523 Information disclosure in ansible CVSS 3.1HIGH 7.5
  • TI-2018-07689 Untrusted search path in [UNKNOWN] ansible CVSS 3.1HIGH 7.8
  • TI-2018-07688 Untrusted search path in [UNKNOWN] ansible CVSS 3.0HIGH 7.8
  • TI-2020-01681 Path traversal in Red Hat Ansible CVSS 3.1HIGH 7.8
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences