GHSA-cqmr-rcpr-cxh3
Suggest an improvement- Source
- https://github.com/advisories/GHSA-cqmr-rcpr-cxh3
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-cqmr-rcpr-cxh3/GHSA-cqmr-rcpr-cxh3.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-cqmr-rcpr-cxh3
- Aliases
- Published
- 2022-05-24T17:01:46Z
- Modified
- 2024-09-04T20:22:33.600697Z
- Severity
-
- 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Ansible password prompts could expose passwords
- Details
-
ansible-playbook -k and ansible cli tools, all versions 2.8.x before 2.8.4, all 2.7.x before 2.7.13 and all 2.6.x before 2.6.19, prompt passwords by expanding them from templates as they could contain special characters. Passwords should be wrapped to prevent templates trigger and exposing them.
- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2019-10206
- https://github.com/ansible/ansible/commit/4b5aed4e5af4c7aab621662f50a289e99b8ac393
- https://github.com/ansible/ansible/commit/d39488ece44956f6a169a498b067bbef54552be1
- https://github.com/ansible/ansible/commit/d728127310b4f3a40ce8b9df3affb88ffaeea073
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10206
- https://github.com/ansible/ansible
- https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2019-145.yaml
- https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html
- https://www.debian.org/security/2021/dsa-4950
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00021.html
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00026.html
Affected packages
PyPI / ansible
Package
- Name
- ansible
- View open source insights on deps.dev
- Purl
- pkg:pypi/ansible
PyPI / ansible
Package
- Name
- ansible
- View open source insights on deps.dev
- Purl
- pkg:pypi/ansible
PyPI / ansible
Package
- Name
- ansible
- View open source insights on deps.dev
- Purl
- pkg:pypi/ansible