Ansible password prompts could expose passwords
Moderate severity
GitHub Reviewed
Published
May 24, 2022
to the GitHub Advisory Database
•
Updated Oct 19, 2023
Package
Affected versions
>= 2.8.0, < 2.8.6
>= 2.7.0, < 2.7.14
< 2.6.20
Patched versions
2.8.6
2.7.14
2.6.20
Description
Published by the National Vulnerability Database
Nov 26, 2019
Published to the GitHub Advisory Database
May 24, 2022
Reviewed
Oct 19, 2023
Last updated
Oct 19, 2023
A data disclosure flaw was found in ansible. Password prompts in ansible-playbook and ansible-cli tools could expose passwords with special characters as they are not properly wrapped. A password with special characters is exposed starting with the first of these special characters. The highest threat from this vulnerability is to data confidentiality.
This CVE exists due to an incomplete fix for CVE-2019-10206.
References