Fluid Attacks Database

Description

Ansible sensitive information disclosure ansible before versions 2.5.14, 2.6.11, 2.7.5 is vulnerable to a information disclosure flaw in vvv+ mode with no_log on that can lead to leakage of sensible data.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
pypi	ansible	>=0 <2.5.14 \|\| >=2.6.0a1 <2.6.11 \|\| >=2.7.0a1 <2.7.5	2.5.14, 2.6.11, 2.7.5
alpine v3.9	ansible	>=2.5.0 <2.7.5-r0	2.7.5-r0
alpine v3.10	ansible	>=2.5.0 <2.7.9-r0	2.7.9-r0
alpine v3.11	ansible	>=2.5.0 <2.7.9-r0	2.7.9-r0
alpine v3.12	ansible	>=2.5.0 <2.7.9-r0	2.7.9-r0
alpine v3.8	ansible	>=2.5.0 <2.5.14-r0	2.5.14-r0
alpine v3.13	ansible-base	>=0 <2.7.9-r0	2.7.9-r0
alpine v3.14	ansible-base	>=0 <2.7.9-r0	2.7.9-r0
debian 12	ansible	>=0 <2.7.6+dfsg-1	2.7.6+dfsg-1
debian 13	ansible	>=0 <2.7.6+dfsg-1	2.7.6+dfsg-1

1-10 of 11

Aliases

1. CVE-2018-168762. NVD-2018-168763. OSV-2018-168764. OSV-ALPINE-2018-168765. OSV-DEBIAN-2018-168766. GCVE-2018-168767. access.redhat.com8. access.redhat.com9. access.redhat.com10. access.redhat.com11. access.redhat.com12. access.redhat.com13. SECURITY-CVE-2018-1687614. SECURITY-TRACKER-CVE-2018-16876

References

1. https://github.com/ansible/ansible/issues/513182. https://github.com/ansible/ansible/pull/495693. https://github.com/ansible/ansible/commit/e0a81d133ffc8f7067182c53cf6a28c724dd10994. https://github.com/ansible/ansible/commit/0954942dfdc563f80fd3e388f550aa165ec931da5. https://github.com/ansible/ansible/commit/424c68f15ad9f532d73e5afed33ff477f54281a76. https://www.debian.org/security/2019/dsa-43967. https://web.archive.org/web/20200227100904/http://www.securityfocus.com/bid/1062258. https://usn.ubuntu.com/4072-19. https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2019-141.yaml10. https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1687611. http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00021.html12. http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00077.html13. http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00020.html

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.