CVE-2019-14858: red hat ansible Improper Output Neutralization for Logs
Vulnerability summary
CVE-2019-14858 is a high (CVSS 7.3) Improper Output Neutralization for Logs vulnerability in red hat ansible. EPSS estimates a 0.42% chance of exploitation in the next 30 days, higher than 36.7% of scored vulnerabilities.
Not severe (CVSS 7.3, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 14 · Related 8Timeline
- 14-10-2019PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. When a module has an argument_spec with sub parameters marked as no_log, passing an invalid parameter name to the module will cause the task to fail before the no_log options in the sub parameters are processed. As a result, data in the sub parameter fields will not be masked and will be displayed if Ansible is run with increased verbosity and present in the module invocation arguments for the task.
CVSS metrics
10 scores · 6 sources · 4 versions- OSV · AlpineEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- OSV · PypiEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- NVDNIST7.3HighCVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated7.3HighCVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.42%
Chance of exploitation in the next 30 days
Percentile
37%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.42% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-117Improper Output Neutralization for LogsThe product constructs a log message from external input, but it does not neutralize or incorrectly neutralizes special elements when the message is written to a log file.
- CWE-532Insertion of Sensitive Information into Log FileThe product writes sensitive information to a log file.
Affected systems
Known conditions: local access, low-privilege account, user interaction (CVSS vector). Other conditions: not stated in public data.
Alpine2 products
- ansible< 2.8.6-r0 | < 2.6.20-r0 | < 2.7.14-r0
- ansible-base< 2.8.6-r0
Redhat2 products
- ansible_engine≥ 2.0, ≤ 2.8.0
- ansible_tower≥ 3.0, ≤ 3.5.0
Debian1 product
- ansible< 2.8.6+dfsg-1
PyPI1 product
- ansible≥ 2.9.0a1, < 2.9.0rc4 | ≥ 2.8.0a1, < 2.8.6 | ≥ 2.7.0a1, < 2.7.14 | ≥ 2.0, < 2.6.20 | ≥ 2.0, < 2.8.1
Red hat1 product
- ansibleansible_engine-2.x up to 2.8 | ansible_tower-3.x up to 3.5
Ubuntu1 product
- ansibleAll versions (No fix recorded)
6 vendors · 8 products
References
22 links- bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14858X Refsource CONFIRMIssue TrackingThird Party AdvisoryWEBREPORT
- lists.opensuse.org/opensuse-security-announce/2020-04/msg00021.htmlVendor AdvisoryX Refsource SUSEWEB
- lists.opensuse.org/opensuse-security-announce/2020-04/msg00026.htmlVendor AdvisoryX Refsource SUSEWEB
Show all 22 references
- github.com/ansible/ansiblePACKAGE
