The remote Redhat Enterprise Linux 7 / 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:3207 advisory.

  - ansible: secrets disclosed on logs when no_log enabled (CVE-2019-14846)

  - ansible: Incomplete fix for CVE-2019-10206 (CVE-2019-14856)

  - ansible: sub parameters marked as no_log are not masked in certain failure scenarios (CVE-2019-14858)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:3202 advisory.

  - ansible: secrets disclosed on logs when no_log enabled (CVE-2019-14846)

  - ansible: Incomplete fix for CVE-2019-10206 (CVE-2019-14856)

  - ansible: sub parameters marked as no_log are not masked in certain failure scenarios (CVE-2019-14858)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:3203 advisory.

  - ansible: secrets disclosed on logs when no_log enabled (CVE-2019-14846)

  - ansible: Incomplete fix for CVE-2019-10206 (CVE-2019-14856)

  - ansible: sub parameters marked as no_log are not masked in certain failure scenarios (CVE-2019-14858)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:0756 advisory.

  - ansible: secrets disclosed on logs when no_log enabled (CVE-2019-14846)

  - ansible: Incomplete fix for CVE-2019-10206 (CVE-2019-14856)

  - ansible: sub parameters marked as no_log are not masked in certain failure scenarios (CVE-2019-14858)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for ansible to version 2.9.6 fixes the following issues :

Security issues fixed :

  - CVE-2019-14904: Fixed a vulnerability in solaris_zone     module via crafted solaris zone (boo#1157968).

  - CVE-2019-14905: Fixed an issue where malicious code     could craft filename in nxos_file_copy module     (boo#1157969).

  - CVE-2019-14864: Fixed Splunk and Sumologic callback     plugins leak sensitive data in logs (boo#1154830).

  - CVE-2019-14846: Fixed secrets disclosure on logs due to     display is hardcoded to DEBUG level (boo#1153452)

  - CVE-2019-14856: Fixed insufficient fix for     CVE-2019-10206 (boo#1154232)

  - CVE-2019-14858: Fixed data in the sub parameter fields     that will not be masked and will be displayed when run     with increased verbosity (boo#1154231) 

  - CVE-2019-10206: ansible-playbook -k and ansible cli     tools prompt passwords by expanding them from templates     as they could contain special characters. Passwords     should be wrapped to prevent templates trigger and     exposing them. (boo#1142690)

  - CVE-2019-10217: Fields managing sensitive data should be     set as such by no_log feature. Some of these fields in     GCP modules are not set properly.
    service_account_contents() which is common class for all     gcp modules is not setting no_log to True. Any sensitive     data managed by that function would be leak as an output     when running ansible playbooks. (boo#1144453)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:3201 advisory.

  - ansible: secrets disclosed on logs when no_log enabled (CVE-2019-14846)

  - ansible: Incomplete fix for CVE-2019-10206 (CVE-2019-14856)

  - ansible: sub parameters marked as no_log are not masked in certain failure scenarios (CVE-2019-14858)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
193991	RHEL 7 / 8 : Ansible (RHSA-2019:3207)	Nessus	Red Hat Local Security Checks	4/27/2024	4/27/2024	high
130331	RHEL 7 : Ansible (RHSA-2019:3202)	Nessus	Red Hat Local Security Checks	10/28/2019	4/28/2024	high
130332	RHEL 7 / 8 : Ansible (RHSA-2019:3203)	Nessus	Red Hat Local Security Checks	10/28/2019	4/28/2024	high
170292	RHEL 7 : ansible (RHSA-2020:0756)	Nessus	Red Hat Local Security Checks	1/23/2023	5/25/2023	high
135454	openSUSE Security Update : ansible (openSUSE-2020-513)	Nessus	SuSE Local Security Checks	4/14/2020	3/19/2024	high
130330	RHEL 7 : Ansible (RHSA-2019:3201)	Nessus	Red Hat Local Security Checks	10/28/2019	4/27/2024	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high