tocsin

PyPI/ansible CVE-2019-14846: high 7.8, EPSS 0.51%

In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG level which lead to a disclosure of credentials if a plugin

Action: Upgrade ansible to 2.6.20 or later.

pip install ansible==2.6.20
pip install ansible==2.7.14
pip install ansible==2.8.6

Affected

introducedfixedlast affected
02.6.20-
2.7.02.7.14-
2.8.02.8.6-

Fixed versions

2.6.202.7.142.8.6

Sources

CVE-2019-14846 · published · modified · JSON