CVE-2019-10217

State: Published
Severity: 5.7 Medium
Published: Nov 25, 2019
Updated: Aug 4, 2024
Reserved: Mar 27, 2019

Description

A flaw was found in ansible 2.8.0 before 2.8.4. Fields managing sensitive data should be set as such by no_log feature. Some of these fields in GCP modules are not set properly. service_account_contents() which is common class for all gcp modules is not setting no_log to True. Any sensitive data managed by that function would be leak as an output when running ansible playbooks.

Scores

CVSS	Score	Vector	Source
3.0	5.7 Medium	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N	redhat

Weaknesses

CWE-200

Affected Products

Product	Versions
AnsibleRed Hat	ansible 2.8.0 before 2.8.4Affected

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10217
https://github.com/ansible/ansible/issues/56269
https://github.com/ansible/ansible/pull/59427
openSUSE-SU-2020:0513vendor-advisory
openSUSE-SU-2020:0523vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.