CVE-2019-10156

MEDIUM

Description

A flaw was discovered in the way Ansible templating was implemented in versions before 2.6.18, 2.7.12 and 2.8.2, causing the possibility of information disclosure through unexpected variable substitution. By taking advantage of unintended variable substitution the content of any variable may be disclosed.

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10156

https://github.com/ansible/ansible/pull/57188

https://lists.debian.org/debian-lts-announce/2019/09/msg00016.html

Details

Source: MITRE

Published: 2019-07-30

Updated: 2019-09-16

Type: CWE-200

Risk Information

CVSS v2.0

Base Score: 5.5

Vector: AV:N/AC:L/Au:S/C:P/I:P/A:N

Impact Score: 4.9

Exploitability Score: 8

Severity: MEDIUM

CVSS v3.0

Base Score: 5.4

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Impact Score: 2.5

Exploitability Score: 2.8

Severity: MEDIUM