CVE-2019-14864: debian debian_linux Improper Output Neutralization for Logs
Vulnerability summary
CVE-2019-14864 is a medium (CVSS 6.5) Improper Output Neutralization for Logs vulnerability in debian debian_linux. EPSS estimates a 1.86% chance of exploitation in the next 30 days, higher than 79.2% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 5.7, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 9 · Related 8Timeline
- 02-01-2020PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumologic and Splunk callback plugins are used send tasks results events to collectors. This would discloses and collects any sensitive data.
CVSS metrics
10 scores · 7 sources · 3 versions- OSV · AlpineEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- OSV · PypiEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- NVDNIST5.7MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
- OSV · Red hatEcosystem advisory · calculated5.7MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated5.7MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
EPSS trend
Probability
1.86%
Chance of exploitation in the next 30 days
Percentile
79%
Versus all other CVEs
30-day change
Decrease -0.02 pp
From 1.87% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundAnsible
Maturity: poc
Weaknesses
CWE · root cause- CWE-117Improper Output Neutralization for LogsThe product constructs a log message from external input, but it does not neutralize or incorrectly neutralizes special elements when the message is written to a log file.
- CWE-532Insertion of Sensitive Information into Log FileThe product writes sensitive information to a log file.
Affected systems
Known conditions: network-reachable, low-privilege account, user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat7 products
- ansible≥ 2.7.0, < 2.7.15 | ≥ 2.8.0, < 2.8.7 | ≥ 2.9.0, < 2.9.1
- ansible_tower3.0
- ceph_storage3.0
- cloudforms_management_engine5.0
- enterprise_linuxEOL6.0 | 7.0 | 8.0
Debian2 products
- ansible< 2.9.2+dfsg-1
- debian_linuxEOL10.0
Opensuse2 products
- backports_sle15.0:sp1
- leapEOL15.1
Alpine1 product
- ansible≥ 2.7.0, < 2.8.8-r0 | ≥ 2.7.0, < 2.7.16-r0
Mageia1 product
- ansible< 2.7.15-1.mga7
PyPI1 product
- ansible≥ 2.7.0a1, < 2.7.15 | ≥ 2.8.0a1, < 2.8.7 | ≥ 2.9.0a1, < 2.9.1 | ≥ 2.9.0, < 2.9.1
Red hat1 product
- ansibleAnsible versions 2.9.x before 2.9.1 | Ansible versions 2.8.x before 2.8.7 | Ansible versions 2.7.x before 2.7.15
Ubuntu1 product
- ansible< 2.9.2+dfsg-1
8 vendors · 16 products
References
35 links- bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14864X Refsource CONFIRMIssue TrackingPatchVendor AdvisoryWEBREPORT
- lists.opensuse.org/opensuse-security-announce/2020-04/msg00021.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party AdvisoryWEB
- lists.opensuse.org/opensuse-security-announce/2020-04/msg00026.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party AdvisoryWEB
Show all 35 references
- github.com/ansible/ansiblePACKAGE