GHSA-cqmr-rcpr-cxh3
Ansible password prompts could expose passwords
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2019-10206
- Alias
- PYSEC-2019-145
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Description
ansible-playbook -k and ansible cli tools, all versions 2.8.x before 2.8.4, all 2.7.x before 2.7.13 and all 2.6.x before 2.6.19, prompt passwords by expanding them from templates as they could contain special characters. Passwords should be wrapped to prevent templates trigger and exposing them.
Paquets affectés
| Paquet | Versions |
|---|---|
| PyPI · ansible | introduced 2.8.0, fixed 2.8.4 |
| PyPI · ansible | introduced 2.7.0, fixed 2.7.13 |
| PyPI · ansible | introduced 2.6.0, fixed 2.6.19 |
Références
- https://nvd.nist.gov/vuln/detail/CVE-2019-10206 ADVISORY
- https://github.com/ansible/ansible/commit/4b5aed4e5af4c7aab621662f50a289e99b8ac393 WEB
- https://github.com/ansible/ansible/commit/d39488ece44956f6a169a498b067bbef54552be1 WEB
- https://github.com/ansible/ansible/commit/d728127310b4f3a40ce8b9df3affb88ffaeea073 WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10206 WEB
- https://github.com/ansible/ansible PACKAGE
- https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2019-145.yaml WEB
- https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html WEB
- https://www.debian.org/security/2021/dsa-4950 WEB
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00021.html WEB
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00026.html WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |