{"action":"Upgrade ansible to 2.6.20 or later.","affected":[{"fixed":"2.6.20","introduced":"0"},{"fixed":"2.7.14","introduced":"2.7.0"},{"fixed":"2.8.6","introduced":"2.8.0"}],"component":"ansible","cve_ids":["CVE-2019-14846"],"ecosystem":"PyPI","epss":0.00513,"exploited":false,"fixed_versions":["2.6.20","2.7.14","2.8.6"],"ghsa_id":"GHSA-pm48-cvv2-29q5","id":"tcs_01M5KG981ER2095QNSDSCVAX1R","modified_at":"2026-06-10T17:00:18.930239347Z","published_at":"2019-10-08T19:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2019-4","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14846","https://github.com/ansible/ansible/pull/63366","https://access.redhat.com/errata/RHSA-2019:3207","https://access.redhat.com/errata/RHSA-2019:3201","https://access.redhat.com/errata/RHSA-2019:3202","https://access.redhat.com/errata/RHSA-2019:3203","https://access.redhat.com/errata/RHSA-2020:0756","http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00021.html","http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00026.html","https://lists.debian.org/debian-lts-announce/2020/05/msg00005.html","https://lists.debian.org/debian-lts-announce/2021/01/msg00023.html","https://github.com/advisories/GHSA-pm48-cvv2-29q5"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2019-4","url":"https://osv.dev/vulnerability/PYSEC-2019-4"}],"summary":"In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG level which lead to a disclosure of credentials if a plugin"}