Ansible CVE-2019-14858 Information Disclosure Vulnerability

Description

Ansible is prone to an information-disclosure vulnerability. Successfully exploiting this issue may allow an attacker to obtain sensitive information that may aid in further attacks. Versions prior to Ansible 2.6.20, 2.7.14, 2.8.6 and 2.9.0rc4 are vulnerable.

Technologies Affected

• AnsibleWorks ansible 2.6.0
• AnsibleWorks ansible 2.6.10
• AnsibleWorks ansible 2.6.11
• AnsibleWorks ansible 2.6.13
• AnsibleWorks ansible 2.6.14
• AnsibleWorks ansible 2.6.19
• AnsibleWorks ansible 2.6.5
• AnsibleWorks ansible 2.6.6
• AnsibleWorks ansible 2.6.7
• AnsibleWorks ansible 2.6.8
• AnsibleWorks ansible 2.6.9
• AnsibleWorks ansible 2.7.0
• AnsibleWorks ansible 2.7.1
• AnsibleWorks ansible 2.7.13
• AnsibleWorks ansible 2.7.2
• AnsibleWorks ansible 2.7.3
• AnsibleWorks ansible 2.7.4
• AnsibleWorks ansible 2.7.5
• AnsibleWorks ansible 2.7.7
• AnsibleWorks ansible 2.7.8
• AnsibleWorks ansible 2.8.0
• AnsibleWorks ansible 2.8.1
• AnsibleWorks ansible 2.8.2
• AnsibleWorks ansible 2.8.4
• AnsibleWorks ansible 2.8.5
• Redhat Ansible Engine For RHEL 7 2
• Redhat Ansible Engine For RHEL 7 2.6
• Redhat Ansible Engine For RHEL 7 2.7
• Redhat Ansible Engine For RHEL 7 2.8
• Redhat Ansible Engine For RHEL 8 2
• Redhat Ansible Engine For RHEL 8 2.8
• Redhat Ansible Tower 3.0.0
• Redhat Ceph Storage 2
• Redhat Ceph Storage 3
• Redhat CloudForms Management Engine 5.0
• Redhat OpenStack Platform 10
• Redhat OpenStack Platform 13
• Redhat OpenStack Platform 14
• Redhat Satellite 6
• Redhat Storage Server 3.0

Recommendations

Permit local access for trusted individuals only. Where possible, use restricted environments and restricted shells.
Given the local nature of this issue, grant only trusted and accountable individuals access to affected computers.

Run all software as a nonprivileged user with minimal access rights.
To reduce the impact of latent vulnerabilities, always run nonadministrative software as an unprivileged user with minimal access rights.

Updates are available. Please see the references or vendor advisory for more information.