Vulnetix
Try Vulnetix Request Demo
ALPINE-CVE-2019-14846 PUBLISHED CVSS 7.800000190734863 HIGH

In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG level which lead to a disclosure of credentials if a plugin used a library that logged credentials at the DEBUG level. This flaw does not affect Ansible modules, as those are executed in a separate process.

Risk Scores

CVSS v3.1
7.800000190734863
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Products

VendorProductVersions
Alpine:v3.8ansible2.6.19-r0, 2.5.5-r0, 2.5.4-r0
Alpine:v3.13ansible-base2.2.1.0-r1, 2.2.1.0-r0, 2.2.0.0-r0
Alpine:v3.11ansible2.8.6-r0, 2.8.6-r1, 2.8.6-r2
Alpine:v3.12ansible2.0.0.2-r0, 2.0.0.2-r1, 2.0.1.0-r1
Alpine:v3.14ansible-base2.8.4-r0, 0, 0.3.1-r0
Alpine:v3.10ansible1.6.1-r0, 1.5.5-r0, 1.5.4-r0
Alpine:v3.9ansible2.7.0-r1, 1.2.1-r1, 1.2.2-r0

Timeline

References

Open in Interactive Console →