CVE-2019-10206 Ansible password prompts could expose passwords
Ansible CLI tools may expose passwords by expanding them from templates, allowing attackers to read sensitive credentials.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-10206?
CVE-2019-10206 is a medium-severity vulnerability in Debian Debian Linux, published on 22 Nov 2019. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
ansible-playbook -k and ansible cli tools, all versions 2.8.x before 2.8.4, all 2.7.x before 2.7.13 and all 2.6.x before 2.6.19, prompt passwords by expanding them from templates as they could contain special characters. Passwords should be wrapped to prevent templates trigger and exposing them.
Weakness: CWE-522
Which versions are affected by CVE-2019-10206?
7 open source packages ship an affected version, including ansible. It affects 4 products.
| Package | Affected | Fixed in |
|---|---|---|
ansible PyPI | From 2.6.0 | 2.6.19, 2.7.13, 2.8.4 |
ansible PyPI | From 2.6.0 | 2.6.19 |
ansible PyPI | From 2.6.0 | 2.6.19 |
ansible PyPI | From 2.7.0 | 2.7.13 |
ansible PyPI | From 2.7.0 | 2.7.13 |
ansible PyPI | From 2.8.0 | 2.8.4 |
1 more packages
ansible PyPI | From 2.8.0 | 2.8.4 |
Linux distribution packages (5)
ansible Red Hat:ansible_engine:2.6::el7 | All versions | 0:2.6.19-1.el7ae |
ansible Red Hat:ansible_engine:2.7::el7 | All versions | 0:2.7.13-1.el7ae |
ansible SUSE:HPE Helion OpenStack 8 | All versions | 2.4.6.0-3.6.1 |
ansible SUSE:OpenStack Cloud 8 | All versions | 2.4.6.0-3.6.1 |
ansible SUSE:OpenStack Cloud Crowbar 8 | All versions | 2.4.6.0-3.6.1 |
Products include Debian Debian Linux, Opensuse Backports Sle, Opensuse Leap, Redhat Ansible.
How do I fix CVE-2019-10206?
Upgrade ansible to a fixed version for your release line: 2.6.19, 2.7.13 or 2.8.4.
Is CVE-2019-10206 being exploited?
There is no known exploitation of CVE-2019-10206 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2019-10206, DEBIAN-CVE-2019-10206, GHSA-cqmr-rcpr-cxh3, PYSEC-2019-145, RHSA-2019:2544, RHSA-2019:2545 and 2 more.