{"id":"CVE-2019-10206","published":"2019-11-22T00:00:00Z","modified":"2024-08-04T22:17:18Z","title":"ansible-playbook -k and ansible cli tools, all versions 2.8.x before 2.8.4, all 2.7.x before 2.7.13 and all 2.6.x…","vendor":"Red Hat","product":"Ansible","tier":"tail","description":{"text":"ansible-playbook -k and ansible cli tools, all versions 2.8.x before 2.8.4, all 2.7.x before 2.7.13 and all 2.6.x before 2.6.19, prompt passwords by expanding them from templates as they could contain special characters. Passwords should be wrapped to prevent templates trigger and exposing them.","provenance":"source","from":"CVE.org"},"cvss":{"score":6.4,"severity":"MEDIUM","version":"3.0","vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01515,"percentile":0.74417,"provenance":"source"},"cwes":[{"id":"CWE-522","name":"Insufficiently Protected Credentials"}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00021.html","tags":["vendor-advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00026.html","tags":["vendor-advisory"]},{"url":"https://www.debian.org/security/2021/dsa-4950","tags":["vendor-advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10206","tags":[]},{"url":"https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html","tags":["mailing-list"]}],"priority":{"score":19.4,"factors":[{"name":"EPSS percentile","points":14.88},{"name":"CVSS severity","points":4.48}]},"vendorSlug":"red-hat","affectedVersions":[{"vendor":"Red Hat","product":"Ansible","versions":["all 2.8.x before 2.8.4","all 2.7.x before 2.7.13","all 2.6.x before 2.6.19"]}],"affected":[{"ecosystem":"PyPI","package":"ansible","vulnerableRanges":[">=2.8.0, <2.8.4",">=2.7.0, <2.7.13",">=2.6.0, <2.6.19"],"patched":["2.8.4","2.7.13","2.6.19"],"from":["GHSA-cqmr-rcpr-cxh3","PYSEC-2019-145"],"provenance":"source"}],"euvd":{"id":"EUVD-2019-0003","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-unknown-ansible-cve-2016-9587","parents":[{"from":"CVE-2018-10874","to":"CVE-2019-10206","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["lib/ansible/cli/__init__.py"],"commits":["https://github.com/ansible/ansible/commit/44874addc7ea136f83c67d5869047ece02645fdb","https://github.com/ansible/ansible/commit/1f80949f964a946773f9d3ac1899535bd2cc2b8e","https://github.com/ansible/ansible/commit/4b5aed4e5af4c7aab621662f50a289e99b8ac393","https://github.com/ansible/ansible/commit/d39488ece44956f6a169a498b067bbef54552be1"],"basis":"rarely changed file"}]}],"children":[{"from":"CVE-2019-10206","to":"CVE-2019-14856","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:ansible","fromFixed":"2.6.19","toFixed":"2.6.20","daysApart":4},{"kind":"same-code","provenance":"machine","files":["lib/ansible/cli/__init__.py"],"commits":["https://github.com/ansible/ansible/commit/4b5aed4e5af4c7aab621662f50a289e99b8ac393","https://github.com/ansible/ansible/commit/d39488ece44956f6a169a498b067bbef54552be1","https://github.com/ansible/ansible/commit/16684f118715a52e1c46d437652add9ca36423de","https://github.com/ansible/ansible/commit/2cbd8775ca1271195169f62122df1f88b532e74f"],"basis":"shared function","functions":["ask_passwords"]}]}],"packageHistory":[{"cve":"CVE-2019-3828","published":"2019-03-27","fixed":"2.7.8","kev":false},{"cve":"CVE-2018-16859","published":"2018-11-29","fixed":"2.8.1","kev":false},{"cve":"CVE-2019-10156","published":"2019-07-30","fixed":"2.8.2","kev":false,"link":{"from":"CVE-2019-10156","to":"CVE-2019-10206","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:ansible","fromFixed":"2.8.2","toFixed":"2.8.4","daysApart":115}]}},{"cve":"CVE-2019-10206","published":"2019-11-22","fixed":"2.8.4","kev":false},{"cve":"CVE-2019-10217","published":"2019-11-25","fixed":"2.8.4","kev":false},{"cve":"CVE-2019-14846","published":"2019-10-08","fixed":"2.8.6","kev":false},{"cve":"CVE-2019-14856","published":"2019-11-26","fixed":"2.8.6","kev":false}],"package":"PyPI:ansible"}}