Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumologic and Splunk callback plugins are used send tasks results events to collectors. This would discloses and collects any sensitive data.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not
    respecting the flag no_log set it to True when Sumologic and Splunk callback plugins are used send tasks
    results events to collectors. This would discloses and collects any sensitive data. (CVE-2019-14864)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not
    respecting the flag no_log set it to True when Sumologic and Splunk callback plugins are used send tasks
    results events to collectors. This would discloses and collects any sensitive data. (CVE-2019-14864)

  - A flaw was found in the solaris_zone module from the Ansible Community modules. When setting the name for
    the zone on the Solaris host, the zone name is checked by listing the process with the 'ps' bare command
    on the remote machine. An attacker could take advantage of this flaw by crafting the name of the zone and
    executing arbitrary commands in the remote host. Ansible Engine 2.7.15, 2.8.7, and 2.9.2 as well as
    previous versions are affected. (CVE-2019-14904)

  - A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before
    2.7.16 and earlier, where in Ansible's nxos_file_copy module can be used to copy files to a flash or
    bootflash on NXOS devices. Malicious code could craft the filename parameter to perform OS command
    injections. This could result in a loss of confidentiality of the system among other issues.
    (CVE-2019-14905)

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-4950 advisory.

    Several vulnerabilities have been found in Ansible, a configuration management, deployment and task     execution system, which could result in information disclosure or argument injection. In addition a race     condition in become_user was fixed. For the stable distribution (buster), these problems have been fixed     in version 2.7.7+dfsg-1+deb10u1. We recommend that you upgrade your ansible packages. For the detailed     security status of ansible please refer to its security tracker page at: https://security-     tracker.debian.org/tracker/ansible

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for ansible to version 2.9.6 fixes the following issues :

Security issues fixed :

  - CVE-2019-14904: Fixed a vulnerability in solaris_zone     module via crafted solaris zone (boo#1157968).

  - CVE-2019-14905: Fixed an issue where malicious code     could craft filename in nxos_file_copy module     (boo#1157969).

  - CVE-2019-14864: Fixed Splunk and Sumologic callback     plugins leak sensitive data in logs (boo#1154830).

  - CVE-2019-14846: Fixed secrets disclosure on logs due to     display is hardcoded to DEBUG level (boo#1153452)

  - CVE-2019-14856: Fixed insufficient fix for     CVE-2019-10206 (boo#1154232)

  - CVE-2019-14858: Fixed data in the sub parameter fields     that will not be masked and will be displayed when run     with increased verbosity (boo#1154231) 

  - CVE-2019-10206: ansible-playbook -k and ansible cli     tools prompt passwords by expanding them from templates     as they could contain special characters. Passwords     should be wrapped to prevent templates trigger and     exposing them. (boo#1142690)

  - CVE-2019-10217: Fields managing sensitive data should be     set as such by no_log feature. Some of these fields in     GCP modules are not set properly.
    service_account_contents() which is common class for all     gcp modules is not setting no_log to True. Any sensitive     data managed by that function would be leak as an output     when running ansible playbooks. (boo#1144453)

An update of the ansible package has been released.

The version of Ansible Tower running on the remote web server is 3.5.x prior to 3.5.4 or 3.6.x prior to 3.6.2. It is, therefore, affected by multiple vulnerabilities.

  - An information disclosure vulnerability exists in the Sumologic and Splunk callback plugins due to Ansible     not respecting the 'no_log' flag. A remote attacker can exploit this via the plugin collectors to     potentially disclose sensitive information.  (CVE-2019-14864)

  - A flaw exists in RabbitMQ manager with the rabbitmq_enable_manager setting due to the setting exposing the     RabbigMQ manager management interface publicly, which may still have the default admin user active. An     unauthenticated, remote attacker can exploit this by guessing the default admin credentials and gain     access to the system. (CVE-2019-19340)

  - An information disclosure vulnerability exists in Ansible Tower backups, due to files in     '/var/backup/tower' being left world-readable while a Tower backup is running. An authenticated, remote     attacker with knowledge of the backup can exploit this by navigating to the '/var/backup/tower' directory     and accessing the files, which includes both the SECRET_KEY, backup files, and every credential stored in     Tower. (CVE-2019-19341)

  - An information disclosure vulnerability exists in '/websocket' due to Ansible Tower mishandling passwords     with the '#' character, and partially disclosing plaintext passwords when '/websocket' is requested. An     unauthenticated, remote attacker can exploit this via HTTP to disclose partial passwords, allowing the     attacker to brute force or guess predictable passwords. (CVE-2019-19342)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:3928 advisory.

    Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task     execution system. Ansible works over SSH and does not require any software or daemons to be installed on     remote nodes. Extension modules can be written in any language and are transferred to managed machines     automatically.

    Security Fix(es):

    Ansible: Splunk and Sumologic callback plugins leak sensitive data in logs (CVE-2019-14864)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    The following packages have been upgraded to a newer upstream version:
    ansible (2.9.1)

    Bug Fix(es):

    See:
    https://github.com/ansible/ansible/blob/v2.9.1/changelogs/CHANGELOG-v2.9.rst for details on bug fixes in     this release.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:3927 advisory.

    Ansible is a simple model-driven configuration management, multi-node     deployment, and remote-task execution system. Ansible works over SSH and     does not require any software or daemons to be installed on remote nodes.
    Extension modules can be written in any language and are transferred to     managed machines automatically.

    Security Fix(es):

    Ansible: Splunk and Sumologic callback plugins leak sensitive data in logs     (CVE-2019-14864)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page(s) listed in the References section.

    The following packages have been upgraded to a newer upstream version:
    ansible (2.9.1)

    Bug Fix(es):

    See:
    https://github.com/ansible/ansible/blob/v2.9.1/changelogs/CHANGELOG-v2.9.rst     for details on bug fixes in this release.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2019:3926 advisory.

    Ansible is a simple model-driven configuration management, multi-node     deployment, and remote-task execution system. Ansible works over SSH and     does not require any software or daemons to be installed on remote nodes.
    Extension modules can be written in any language and are transferred to     managed machines automatically.

    Security Fix(es):

    Ansible: Splunk and Sumologic callback plugins leak sensitive data in logs     (CVE-2019-14864)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page(s) listed in the References section.

    The following packages have been upgraded to a newer upstream version:
    ansible (2.8.7)

    Bug Fix(es):

    See:
    https://github.com/ansible/ansible/blob/v2.8.7/changelogs/CHANGELOG-v2.8.rst     for details on bug fixes in this release.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2019:3925 advisory.

    Ansible is a simple model-driven configuration management, multi-node     deployment, and remote-task execution system. Ansible works over SSH and     does not require any software or daemons to be installed on remote nodes.
    Extension modules can be written in any language and are transferred to     managed machines automatically.

    Security Fix(es):

    Ansible: Splunk and Sumologic callback plugins leak sensitive data in logs (CVE-2019-14864)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    The following packages have been upgraded to a newer upstream version:
    ansible (2.7.15)

    Bug Fix(es):

    See:
    https://github.com/ansible/ansible/blob/v2.7.15/changelogs/CHANGELOG-v2.7.rst     for details on bug fixes in this release.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
422954	SCA: security update for ansible (GHSA-3m93-m4q6-mc6v)	Tenable Cloud Security	SCA Checks	Local	medium
422954	SCA: security update for ansible (GHSA-3m93-m4q6-mc6v)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
403513	Alpine: multiple ansible packages: security update to 2.8.8-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
403513	Alpine: multiple ansible packages: security update to 2.8.8-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
403500	Alpine: multiple ansible packages: security update to 2.7.16-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
403500	Alpine: multiple ansible packages: security update to 2.7.16-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
152270	Debian DSA-4950-1 : ansible - security update	Nessus	Debian Local Security Checks	Local	high
135454	openSUSE Security Update : ansible (openSUSE-2020-513)	Nessus	SuSE Local Security Checks	Local	high
133804	Photon OS 3.0: Ansible PHSA-2020-3.0-0058	Nessus	PhotonOS Local Security Checks	Local	medium
133686	Photon OS 2.0: Ansible PHSA-2020-2.0-0207	Nessus	PhotonOS Local Security Checks	Local	medium
132319	Ansible Tower 3.5.x < 3.5.4 / 3.6.x < 3.6.2 Multiple Vulnerabilities	Nessus	CGI abuses	Combined	high
131213	RHEL 7 / 8 : ansible (RHSA-2019:3928)	Nessus	Red Hat Local Security Checks	Local	medium
131212	RHEL 7 / 8 : ansible (RHSA-2019:3927)	Nessus	Red Hat Local Security Checks	Local	medium
131211	RHEL 7 / 8 : ansible (RHSA-2019:3926)	Nessus	Red Hat Local Security Checks	Local	medium
131210	RHEL 7 : ansible (RHSA-2019:3925)	Nessus	Red Hat Local Security Checks	Local	medium

Detections

Analytics

CVE-2019-14864

medium

Tenable Plugins

medium

medium

high

high

high

high

high

high

medium

medium

high

medium

medium

medium

medium