GHSA-grgm-pph5-j5h7
Exposure of Sensitive Information to an Unauthorized Actor in ansible
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2019-10156
- Alias
- PYSEC-2019-2
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Description
A flaw was discovered in the way Ansible templating was implemented in versions before 2.6.18, 2.7.12 and 2.8.2, causing the possibility of information disclosure through unexpected variable substitution. By taking advantage of unintended variable substitution the content of any variable may be disclosed.
Paquets affectés
| Paquet | Versions |
|---|---|
| PyPI · ansible | introduced 0, fixed 2.6.18 |
| PyPI · ansible | introduced 2.7.0a1, fixed 2.7.12 |
| PyPI · ansible | introduced 2.8.0a1, fixed 2.8.2 |
Références
- https://nvd.nist.gov/vuln/detail/CVE-2019-10156 ADVISORY
- https://github.com/ansible/ansible/pull/57188 WEB
- https://github.com/ansible/ansible/commit/04e94274fb92e116e9082cc9b86b1fd05c836922 WEB
- https://github.com/ansible/ansible/commit/3ff6505e8ff0e4655bab008886983476ef903375 WEB
- https://github.com/ansible/ansible/commit/a11c3edfa41e7e4a4db323cdabfc2eae1b61da2a WEB
- https://access.redhat.com/errata/RHSA-2019:3744 WEB
- https://access.redhat.com/errata/RHSA-2019:3789 WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10156 WEB
- https://github.com/advisories/GHSA-grgm-pph5-j5h7 ADVISORY
- https://github.com/ansible/ansible PACKAGE
- https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2019-2.yaml WEB
- https://lists.debian.org/debian-lts-announce/2019/09/msg00016.html WEB
- https://lists.debian.org/debian-lts-announce/2021/01/msg00023.html WEB
- https://www.debian.org/security/2021/dsa-4950 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |