CVE-2019-14856 Ansible password prompts could expose passwords
Ansible contains an authentication bypass vulnerability allowing attackers to circumvent security controls.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-14856?
CVE-2019-14856 is a medium-severity authentication bypass vulnerability in Opensuse Backports Sle, published on 26 Nov 2019. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
ansible before versions 2.8.6, 2.7.14, 2.6.20 is vulnerable to a None
Weakness: CWE-287
Which versions are affected by CVE-2019-14856?
7 open source packages ship an affected version, including ansible. It affects 4 products.
| Package | Affected | Fixed in |
|---|---|---|
ansible PyPI | From 2.6.0 | 2.6.20, 2.7.14, 2.8.6 |
ansible PyPI | From 2.6.0 | 2.6.20 |
ansible PyPI | From 2.6.0 | 2.6.20 |
ansible PyPI | From 2.7.0 | 2.7.14 |
ansible PyPI | From 2.7.0 | 2.7.14 |
ansible PyPI | From 2.8.0 | 2.8.6 |
1 more packages
ansible PyPI | From 2.8.0 | 2.8.6 |
Products include Opensuse Backports Sle, Opensuse Leap, Redhat Ansible, Redhat Openstack.
How do I fix CVE-2019-14856?
Upgrade ansible to a fixed version for your release line: 2.6.20, 2.7.14 or 2.8.6.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2019-14856 being exploited?
There is no known exploitation of CVE-2019-14856 in the wild and no public exploit code.
Other vulnerabilities in Opensuse Backports Sle
Sources
Also known as ALPINE-CVE-2019-14856, GHSA-6fq2-x65v-v9h7, PYSEC-2019-146.