CVE-2019-10156
- State
- Published
- Severity
- 4.6 Medium
- Published
- Jul 30, 2019
- Updated
- Aug 4, 2024
- Reserved
- Mar 27, 2019
Description
A flaw was discovered in the way Ansible templating was implemented in versions before 2.6.18, 2.7.12 and 2.8.2, causing the possibility of information disclosure through unexpected variable substitution. By taking advantage of unintended variable substitution the content of any variable may be disclosed.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 4.6 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N | redhat |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
ansibleRed Hat |
|
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10156
- https://github.com/ansible/ansible/pull/57188
- [debian-lts-announce] 20190916 [SECURITY] [DLA 1923-1] ansible security updatemailing-list
- RHSA-2019:3744vendor-advisory
- RHSA-2019:3789vendor-advisory
- [debian-lts-announce] 20210127 [SECURITY] [DLA 2535-1] ansible security updatemailing-list
- DSA-4950vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.