Read the docs
TI-2019-11068 Aliases CVE-2019-14864GHSA-3m93-m4q6-mc6v

Sensitive information in log files in Red Hat Ansible

Priority LOW 33CWE-117Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 7 fixed, 7 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-532.

Summary

Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumologic and Splunk callback plugins are used send tasks results events to collectors. This would discloses and collects any sensitive data.

Why it matters now

EPSS 0.01857 79th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial ansible (PyPI): 2.7.15, 2.8.7, 2.9.1Red Hat: 4 advisoriesRed Hat: 7 fixed, 7 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatAnsibleAnsible versions 2.9.x before 2.9.1; Ansible versions 2.8.x before 2.8.7; Ansible versions 2.7.x before 2.7.15—No fix listedCNA
—ansible (PyPI)2.7.0a1 to before 2.7.152.7.15Patch availableGHSA-3m93-m4q6-mc6v
—ansible (PyPI)2.8.0a1 to before 2.8.72.8.7Patch availableGHSA-3m93-m4q6-mc6v
—ansible (PyPI)2.9.0a1 to before 2.9.12.9.1Patch availableGHSA-3m93-m4q6-mc6v
  • Ansible VendorRed Hat Affected Ansible versions 2.9.x before 2.9.1; Ansible versions 2.8.x before 2.8.7; Ansible versions 2.7.x before 2.7.15 Fixed in — No fix listed CNA
  • ansible (PyPI) Vendor— Affected 2.7.0a1 to before 2.7.15 Fixed in 2.7.15 Patch available GHSA-3m93-m4q6-mc6v
  • ansible (PyPI) Vendor— Affected 2.8.0a1 to before 2.8.7 Fixed in 2.8.7 Patch available GHSA-3m93-m4q6-mc6v
  • ansible (PyPI) Vendor— Affected 2.9.0a1 to before 2.9.1 Fixed in 2.9.1 Patch available GHSA-3m93-m4q6-mc6v

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*2.7.0 to before 2.7.15; 2.8.0 to before 2.8.7; 2.9.0 to before 2.9.1VulnerableRed Hat
cpe:2.3:a:redhat:ansible_tower:3.0:*:*:*:*:*:*:*3.0VulnerableRed Hat
cpe:2.3:a:redhat:ceph_storage:3.0:*:*:*:*:*:*:*3.0VulnerableRed Hat
cpe:2.3:a:redhat:cloudforms_management_engine:5.0:*:*:*:*:*:*:*5.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0VulnerableRed Hat
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*15.0 sp1VulnerableopenSUSE
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*15.1VulnerableopenSUSE
  • cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:* Versions 2.7.0 to before 2.7.15; 2.8.0 to before 2.8.7; 2.9.0 to before 2.9.1 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:ansible_tower:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:ceph_storage:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:cloudforms_management_engine:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:* Versions 15.0 sp1 Vulnerable ·openSUSE
  • cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE

Remediation

  • Fix · GHSA-3m93-m4q6-mc6v ansible (PyPI) Fixed in 2.7.15 Advisory →
  • Fix · GHSA-3m93-m4q6-mc6v ansible (PyPI) Fixed in 2.8.7 Advisory →
  • Fix · GHSA-3m93-m4q6-mc6v ansible (PyPI) Fixed in 2.9.1 Advisory →

Red Hat 4 advisories

  • RHSA-2019:3926 Released 2019-11-20 · Red Hat rating Moderate
    ansible security and bug fix update
    • Red Hat Ansible Engine 2.8 for RHEL 7 Server ansible-2.8.7-1.el7ae
    • Red Hat Ansible Engine 2.8 for RHEL 8 ansible-2.8.7-1.el8ae
  • RHSA-2019:3927 Released 2019-11-20 · Red Hat rating Moderate
    ansible security and bug fix update
    • Red Hat Ansible Engine 2.9 for RHEL 7 Server ansible-2.9.1-1.el7, ansible-test-2.9.1-1.el7
    • Red Hat Ansible Engine 2.9 for RHEL 8 ansible-2.9.1-1.el8, ansible-test-2.9.1-1.el8
  • RHSA-2019:3928 Released 2019-11-20 · Red Hat rating Moderate
    ansible security and bug fix update
    • Red Hat Ansible Engine 2 for RHEL 7 ansible-2.9.1-1.el7, ansible-test-2.9.1-1.el7
    • Red Hat Ansible Engine 2 for RHEL 8 ansible-2.9.1-1.el8, ansible-test-2.9.1-1.el8
Show 1 more Red Hat advisories
  • RHSA-2019:3925 Released 2019-11-20 · Red Hat rating Moderate
    ansible security update
    • Red Hat Ansible Engine 2.7 for RHEL 7 Server ansible-2.7.15-1.el7ae

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ceph Storage 2AffectedNo fix planned: Out of support scope
Red Hat Ceph Storage 3AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 10 (Newton)AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 14 (Rocky)AffectedNo fix planned: Will not fix
Red Hat Satellite 6AffectedNo fix planned: Out of support scope
Red Hat Storage 3AffectedNo fix planned: Will not fix
Red Hat Ansible Engine 2 for RHEL 7Fixed RHSA-2019:3928
Red Hat Ansible Engine 2 for RHEL 8Fixed RHSA-2019:3928
Red Hat Ansible Engine 2.7 for RHEL 7 ServerFixed RHSA-2019:3925
Red Hat Ansible Engine 2.8 for RHEL 7 ServerFixed RHSA-2019:3926
Red Hat Ansible Engine 2.8 for RHEL 8Fixed RHSA-2019:3926
Red Hat Ansible Engine 2.9 for RHEL 7 ServerFixed RHSA-2019:3927
Red Hat Ansible Engine 2.9 for RHEL 8Fixed RHSA-2019:3927
Not affected: 2 products
  • CloudForms Management Engine 5
  • Red Hat Ansible Tower 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-14864
  2. 2026-10-03 Alias added: GHSA-3m93-m4q6-mc6v

References

Exploit 1

Patch 2

Advisory 5

Other 9

  • TI-2016-07808 Improper input validation in Ansible CVSS 3.1HIGH 8.1
  • TI-2014-03853 Injection in Ansible CVSS 3.1CRITICAL 9.8
  • TI-2014-03839 The safe_eval function in Ansible before 1.5.4 does not properly restrict the code… CVSS 3.1CRITICAL 9.8
  • TI-2017-05191 Sensitive information in log files in Red Hat ansible CVSS 3.1CRITICAL 9.8
  • TI-2014-04077 Multiple argument injection vulnerabilities in Ansible before 1.6.7 allow remote… CVSS 3.1CRITICAL 9.8
  • TI-2014-04076 Ansible before 1.6.7 does not prevent inventory data with "{{" and "lookup" substrings… CVSS 3.1CRITICAL 9.8
See all 44 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences