{
  "threat_severity" : "Moderate",
  "public_date" : "2019-10-11T00:00:00Z",
  "bugzilla" : {
    "description" : "ansible: sub parameters marked as no_log are not masked in certain failure scenarios",
    "id" : "1760593",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=1760593"
  },
  "cvss3" : {
    "cvss3_base_score" : "5.0",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
    "status" : "verified"
  },
  "cwe" : "CWE-215",
  "details" : [ "A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. When a module has an argument_spec with sub parameters marked as no_log, passing an invalid parameter name to the module will cause the task to fail before the no_log options in the sub parameters are processed. As a result, data in the sub parameter fields will not be masked and will be displayed if Ansible is run with increased verbosity and present in the module invocation arguments for the task.", "A flaw was found in ansible. When a module has an argument_spec with sub parameters marked as no_log, passing an invalid parameter name to the module will cause the task to fail before the no_log options in the sub parameters are processed. As a result, data in the sub parameter fields will not be masked and will be displayed if Ansible is run with increased verbosity and present in the module invocation arguments for the task." ],
  "statement" : "Fixes for Red Hat OpenStack Platform (RHOSP) have been set to 'Moderate' because flaw exploitation requires running Ansible with increased verbosity which is not the RHOSP deployment default.\nRed Hat Gluster Storage no longer maintains its own version of Ansible. The fix will be provided from core Ansible.",
  "acknowledgement" : "This issue was discovered by Sam Doran (Red Hat).",
  "affected_release" : [ {
    "product_name" : "Red Hat Ansible Engine 2.6 for RHEL 7",
    "release_date" : "2019-10-24T00:00:00Z",
    "advisory" : "RHSA-2019:3201",
    "cpe" : "cpe:/a:redhat:ansible_engine:2.6::el7",
    "package" : "ansible-0:2.6.20-1.el7ae",
    "impact" : "moderate"
  }, {
    "product_name" : "Red Hat Ansible Engine 2.7 for RHEL 7",
    "release_date" : "2019-10-24T00:00:00Z",
    "advisory" : "RHSA-2019:3202",
    "cpe" : "cpe:/a:redhat:ansible_engine:2.7::el7",
    "package" : "ansible-0:2.7.14-1.el7ae",
    "impact" : "moderate"
  }, {
    "product_name" : "Red Hat Ansible Engine 2.8 for RHEL 7",
    "release_date" : "2019-10-24T00:00:00Z",
    "advisory" : "RHSA-2019:3203",
    "cpe" : "cpe:/a:redhat:ansible_engine:2.8::el7",
    "package" : "ansible-0:2.8.6-1.el7ae",
    "impact" : "moderate"
  }, {
    "product_name" : "Red Hat Ansible Engine 2.8 for RHEL 8",
    "release_date" : "2019-10-24T00:00:00Z",
    "advisory" : "RHSA-2019:3203",
    "cpe" : "cpe:/a:redhat:ansible_engine:2.8::el8",
    "package" : "ansible-0:2.8.6-1.el8ae",
    "impact" : "moderate"
  }, {
    "product_name" : "Red Hat Ansible Engine 2 for RHEL 7",
    "release_date" : "2019-10-24T00:00:00Z",
    "advisory" : "RHSA-2019:3207",
    "cpe" : "cpe:/a:redhat:ansible_engine:2::el7",
    "package" : "ansible-0:2.8.6-1.el7ae",
    "impact" : "moderate"
  }, {
    "product_name" : "Red Hat Ansible Engine 2 for RHEL 8",
    "release_date" : "2019-10-24T00:00:00Z",
    "advisory" : "RHSA-2019:3207",
    "cpe" : "cpe:/a:redhat:ansible_engine:2::el8",
    "package" : "ansible-0:2.8.6-1.el8ae",
    "impact" : "moderate"
  }, {
    "product_name" : "Red Hat OpenStack Platform 13.0 (Queens)",
    "release_date" : "2020-03-10T00:00:00Z",
    "advisory" : "RHSA-2020:0756",
    "cpe" : "cpe:/a:redhat:openstack:13::el7",
    "package" : "ansible-0:2.6.20-1.el7ae",
    "impact" : "moderate"
  }, {
    "product_name" : "Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS",
    "release_date" : "2020-03-10T00:00:00Z",
    "advisory" : "RHSA-2020:0756",
    "cpe" : "cpe:/a:redhat:openstack:13::el7",
    "package" : "ansible-0:2.6.20-1.el7ae",
    "impact" : "moderate"
  } ],
  "package_state" : [ {
    "product_name" : "CloudForms Management Engine 5",
    "fix_state" : "Not affected",
    "package_name" : "ansible",
    "cpe" : "cpe:/a:redhat:cloudforms_managementengine:5"
  }, {
    "product_name" : "Red Hat Ansible Tower 3",
    "fix_state" : "Affected",
    "package_name" : "ansible",
    "cpe" : "cpe:/a:redhat:ansible_tower:3"
  }, {
    "product_name" : "Red Hat Ceph Storage 2",
    "fix_state" : "Out of support scope",
    "package_name" : "ansible",
    "cpe" : "cpe:/a:redhat:ceph_storage:2"
  }, {
    "product_name" : "Red Hat Ceph Storage 3",
    "fix_state" : "Will not fix",
    "package_name" : "ansible",
    "cpe" : "cpe:/a:redhat:ceph_storage:3"
  }, {
    "product_name" : "Red Hat OpenStack Platform 10 (Newton)",
    "fix_state" : "Will not fix",
    "package_name" : "ansible",
    "cpe" : "cpe:/a:redhat:openstack:10",
    "impact" : "moderate"
  }, {
    "product_name" : "Red Hat OpenStack Platform 14 (Rocky)",
    "fix_state" : "Out of support scope",
    "package_name" : "ansible",
    "cpe" : "cpe:/a:redhat:openstack:14",
    "impact" : "moderate"
  }, {
    "product_name" : "Red Hat Satellite 6",
    "fix_state" : "Out of support scope",
    "package_name" : "ansible",
    "cpe" : "cpe:/a:redhat:satellite:6"
  }, {
    "product_name" : "Red Hat Storage 3",
    "fix_state" : "Will not fix",
    "package_name" : "ansible",
    "cpe" : "cpe:/a:redhat:storage:3"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2019-14858\nhttps://nvd.nist.gov/vuln/detail/CVE-2019-14858" ],
  "name" : "CVE-2019-14858",
  "csaw" : false
}