CVE-2019-14846 Ansible Uses Plugins That Disclose Credentials
Ansible logs credentials at DEBUG level if plugins use libraries that do so, exposing sensitive data to anyone with log access.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-14846?
CVE-2019-14846 is a high-severity vulnerability in Debian Debian Linux, published on 8 Oct 2019. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG level which lead to a disclosure of credentials if a plugin used a library that logged credentials at the DEBUG level. This flaw does not affect Ansible modules, as those are executed in a separate process.
Which versions are affected by CVE-2019-14846?
7 open source packages ship an affected version, including ansible. It affects 5 products.
| Package | Affected | Fixed in |
|---|---|---|
ansible PyPI | All versions | 2.6.20, 2.7.14, 2.8.6 |
ansible PyPI | All versions | 2.6.20 |
ansible PyPI | All versions | 2.6.20 |
ansible PyPI | From 2.7.0a1 | 2.7.14 |
ansible PyPI | From 2.7.0a1 | 2.7.14 |
ansible PyPI | From 2.8.0a1 | 2.8.6 |
1 more packages
ansible PyPI | From 2.8.0a1 | 2.8.6 |
Products include Debian Debian Linux, Opensuse Backports Sle, Opensuse Leap, Redhat Ansible Engine, Redhat Openstack.
How do I fix CVE-2019-14846?
Upgrade ansible to a fixed version for your release line: 2.6.20, 2.7.14 or 2.8.6.
Is CVE-2019-14846 being exploited?
There is no known exploitation of CVE-2019-14846 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2019-14846, CLSA-2025-1744628190, DEBIAN-CVE-2019-14846, GHSA-pm48-cvv2-29q5, PYSEC-2019-4, UBUNTU-CVE-2019-14846.