CVE-2019-14846

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2019-14846
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-14846.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2019-14846
Aliases
Downstream
Related
Published
2019-10-08T19:15:10.400Z
Modified
2026-07-08T05:53:24.622905330Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG level which lead to a disclosure of credentials if a plugin used a library that logged credentials at the DEBUG level. This flaw does not affect Ansible modules, as those are executed in a separate process.

Database specific 
{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "8.0"
                },
                {
                    "last_affected": "8.0"
                },
                {
                    "introduced": "9.0"
                },
                {
                    "last_affected": "9.0"
                },
                {
                    "introduced": "10.0"
                },
                {
                    "last_affected": "10.0"
                }
            ],
            "cpes": [
                "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
                "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
                "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
            ],
            "source": "CPE_STRING",
            "vendor_product": "debian:debian_linux"
        },
        {
            "extracted_events": [
                {
                    "introduced": "15.0-sp1"
                },
                {
                    "last_affected": "15.0-sp1"
                }
            ],
            "cpes": [
                "cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*"
            ],
            "source": "CPE_STRING",
            "vendor_product": "opensuse:backports_sle"
        },
        {
            "extracted_events": [
                {
                    "introduced": "15.1"
                },
                {
                    "last_affected": "15.1"
                }
            ],
            "cpes": [
                "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*"
            ],
            "source": "CPE_STRING",
            "vendor_product": "opensuse:leap"
        },
        {
            "extracted_events": [
                {
                    "introduced": "2.0"
                },
                {
                    "last_affected": "2.0"
                }
            ],
            "cpes": [
                "cpe:2.3:a:redhat:ansible_engine:2.0:*:*:*:*:*:*:*"
            ],
            "source": "CPE_STRING",
            "vendor_product": "redhat:ansible_engine"
        },
        {
            "extracted_events": [
                {
                    "introduced": "13"
                },
                {
                    "last_affected": "13"
                }
            ],
            "cpes": [
                "cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:*"
            ],
            "source": "CPE_STRING",
            "vendor_product": "redhat:openstack"
        }
    ]
}
References

Affected packages

Git / github.com/ansible/ansible

Affected ranges

Type
GIT
Repo
https://github.com/ansible/ansible
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
9bdb89f740a87bcf760424577ce18a8f68d7a741
Introduced
0a07068054090d5b78b27496aa251be74c484b45
Fixed
71affa9d7c2e051951bd8cbd909e6c19203e1a2b
Introduced
2611867fd1dc387ceaa0ffb8ce0f030aafc2a859
Fixed
d778c59c43eea5801658dd993b771a314fc5511b
Last affected
2611867fd1dc387ceaa0ffb8ce0f030aafc2a859
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.6.20"
        },
        {
            "introduced": "2.7.0"
        },
        {
            "fixed": "2.7.14"
        },
        {
            "introduced": "2.8.0"
        },
        {
            "fixed": "2.8.6"
        },
        {
            "last_affected": "2.8.0"
        }
    ],
    "cpe": [
        "cpe:2.3:a:redhat:ansible_engine:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:redhat:ansible_engine:2.8.0:*:*:*:*:*:*:*"
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ]
}

Affected versions

0.*
0.0.1
0.01
0.3
0.7
v1.*
v1.0
v1.1
v1.2
v1.4.0
v1.6.0
v2.*
v2.0.0-0.1.alpha1
v2.0.0-0.2.alpha2
v2.0.0-0.3.beta1
v2.0.0-0.4.beta2
v2.0.0-0.5.beta3
v2.6.0
v2.6.0a1
v2.6.0a2
v2.6.0rc1
v2.6.0rc2
v2.6.0rc3
v2.6.0rc4
v2.6.0rc5
v2.6.1
v2.6.10
v2.6.11
v2.6.12
v2.6.13
v2.6.14
v2.6.15
v2.6.16
v2.6.17
v2.6.18
v2.6.19
v2.6.2
v2.6.3
v2.6.4
v2.6.5
v2.6.6
v2.6.7
v2.6.8
v2.6.9
v2.7.0
v2.7.1
v2.7.10
v2.7.11
v2.7.12
v2.7.13
v2.7.2
v2.7.3
v2.7.4
v2.7.5
v2.7.6
v2.7.7
v2.7.8
v2.7.9
v2.8.0
v2.8.1
v2.8.2
v2.8.3
v2.8.4
v2.8.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-14846.json"