CVE-2020-14332 Insertion of Sensitive Information into Log File and Improper Output Neutralization for Logs in ansible
Ansible Engine fails to neutralize sensitive data in check mode events, allowing unauthorized users to read confidential information.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-14332?
CVE-2020-14332 is a medium-severity vulnerability in Debian Debian Linux, published on 11 Sep 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A flaw was found in the Ansible Engine when using module_args. Tasks executed with check mode (--check-mode) do not properly neutralize sensitive data exposed in the event data. This flaw allows unauthorized users to read this data. The highest threat from this vulnerability is to confidentiality.
Which versions are affected by CVE-2020-14332?
7 open source packages ship an affected version, including ansible. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
ansible PyPI | All versions | 2.8.14 |
ansible PyPI | All versions | 2.8.14 |
ansible PyPI | From 2.10.0a1 | 2.10.1rc2 |
ansible PyPI | From 2.10.0a1 | 2.10.1rc2 |
ansible PyPI | From 2.8.0 | 2.8.14, 2.9.12 |
ansible PyPI | From 2.9.0a1 | 2.9.12 |
1 more packages
ansible PyPI | From 2.9.0a1 | 2.9.12 |
Products include Debian Debian Linux, Redhat Ansible Engine.
How do I fix CVE-2020-14332?
Upgrade ansible to a fixed version for your release line: 2.8.14, 2.10.1rc2 or 2.9.12.
Is CVE-2020-14332 being exploited?
There is no known exploitation of CVE-2020-14332 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2020-14332, DEBIAN-CVE-2020-14332, GHSA-j667-c2hm-f2wp, PYSEC-2020-4, UBUNTU-CVE-2020-14332.